Merge pull request #105026 from thefloweringash/apple-silicon

Native support for Apple Silicon

flake.nix

@@ -18,6 +18,7 @@
         "aarch64-linux"
         "armv6l-linux"
         "armv7l-linux"
+        "aarch64-darwin"
       ];
 
       forAllSystems = f: lib.genAttrs systems (system: f system);

lib/systems/default.nix

@@ -131,7 +131,7 @@ rec {
         else null;
       # The canonical name for this attribute is darwinSdkVersion, but some
       # platforms define the old name "sdkVer".
-      darwinSdkVersion = final.sdkVer or "10.12";
+      darwinSdkVersion = final.sdkVer or (if final.isAarch64 then "11.0" else "10.12");
       darwinMinVersion = final.darwinSdkVersion;
       darwinMinVersionVariable =
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"

lib/systems/doubles.nix

@@ -96,5 +96,5 @@ in {
 
   embedded      = filterDoubles predicates.isNone;
 
-  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux"];
+  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux" "aarch64-darwin"];
 }

lib/systems/examples.nix

@@ -240,6 +240,12 @@ rec {
     useiOSPrebuilt = true;
   };
 
+  aarch64-darwin = {
+    config = "aarch64-apple-darwin";
+    xcodePlatform = "MacOSX";
+    platform = {};
+  };
+
   #
   # Windows
   #

lib/systems/platforms.nix

@@ -375,6 +375,13 @@ rec {
     };
   };
 
+  apple-m1 = {
+    gcc = {
+      arch = "armv8.3-a+crypto+sha2+aes+crc+fp16+lse+simd+ras+rdm+rcpc";
+      cpu = "apple-a13";
+    };
+  };
+
   ##
   ## MIPS
   ##
@@ -495,7 +502,10 @@ rec {
         else if lib.versionOlder version "6" then sheevaplug
         else if lib.versionOlder version "7" then raspberrypi
         else armv7l-hf-multiplatform
-    else if platform.isAarch64 then aarch64-multiplatform
+
+    else if platform.isAarch64 then
+      if platform.isDarwin then apple-m1
+      else aarch64-multiplatform
 
     else if platform.isRiscV then riscv-multiplatform
 

pkgs/applications/graphics/ImageMagick/6.x.nix

@@ -9,7 +9,7 @@ let
     if stdenv.hostPlatform.system == "i686-linux" then "i686"
     else if stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin" then "x86-64"
     else if stdenv.hostPlatform.system == "armv7l-linux" then "armv7l"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64"
+    else if stdenv.hostPlatform.system == "aarch64-linux"  || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
     else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
     else throw "ImageMagick is not supported on this platform.";
 in

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -11,7 +11,7 @@ let
     if stdenv.hostPlatform.system == "i686-linux" then "i686"
     else if stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin" then "x86-64"
     else if stdenv.hostPlatform.system == "armv7l-linux" then "armv7l"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64"
+    else if stdenv.hostPlatform.system == "aarch64-linux"  || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
     else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
     else throw "ImageMagick is not supported on this platform.";
 in

pkgs/build-support/bintools-wrapper/darwin-install_name_tool-wrapper.sh

@@ -0,0 +1,49 @@
+#! @shell@
+# shellcheck shell=bash
+
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+source @signingUtils@
+
+extraAfter=()
+extraBefore=()
+params=("$@")
+
+input=
+
+pprev=
+prev=
+for p in \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
+do
+    if [ "$pprev" != "-change" ] && [[ "$prev" != -* ]] && [[ "$p" != -* ]]; then
+        input="$p"
+    fi
+    pprev="$prev"
+    prev="$p"
+done
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see above.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+@prog@ \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
+
+sign "$input"

pkgs/build-support/bintools-wrapper/darwin-strip-wrapper.sh

@@ -0,0 +1,78 @@
+#! @shell@
+# shellcheck shell=bash
+
+set -eu -o pipefail +o posix
+shopt -s nullglob
+
+if (( "${NIX_DEBUG:-0}" >= 7 )); then
+    set -x
+fi
+
+source @signingUtils@
+
+extraAfter=()
+extraBefore=()
+params=("$@")
+
+output=
+inputs=()
+
+restAreFiles=
+prev=
+for p in \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
+do
+    if [ "$restAreFiles" ]; then
+        inputs+=("$p")
+    else
+        case "$prev" in
+            -s|-R|-d|-arch)
+                # Unrelated arguments with values
+                ;;
+            -o)
+                # Explicit output
+                output="$p"
+                ;;
+            *)
+                # Any other orgument either takes no value, or is a file.
+                if [[ "$p" != -* ]]; then
+                    inputs+=("$p")
+                fi
+                ;;
+        esac
+
+        if [ "$p" == - ]; then
+            restAreFiles=1
+        fi
+    fi
+
+    prev="$p"
+done
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    # Old bash workaround, see above.
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" ${extraBefore+"${extraBefore[@]}"}  >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" ${params+"${params[@]}"} >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" ${extraAfter+"${extraAfter[@]}"} >&2
+fi
+
+@prog@ \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
+
+if [ "$output" ]; then
+    # Single explicit output
+    signIfRequired "$output"
+else
+    # Multiple inputs, rewritten in place
+    for input in "${inputs[@]}"; do
+      signIfRequired "$input"
+    done
+fi

pkgs/build-support/bintools-wrapper/default.nix

@@ -14,6 +14,9 @@
 , extraPackages ? [], extraBuildCommands ? ""
 , buildPackages ? {}
 , useMacosReexportHack ? false
+
+# Darwin code signing support utilities
+, postLinkSignHook ? null, signingUtils ? null
 }:
 
 with lib;
@@ -339,6 +342,24 @@ stdenv.mkDerivation {
       ''
     )
 
+    ##
+    ## Code signing on Apple Silicon
+    ##
+    + optionalString (targetPlatform.isDarwin && targetPlatform.isAarch64) ''
+      echo 'source ${postLinkSignHook}' >> $out/nix-support/post-link-hook
+
+      export signingUtils=${signingUtils}
+
+      wrap \
+        ${targetPrefix}install_name_tool \
+        ${./darwin-install_name_tool-wrapper.sh} \
+        "${bintools_bin}/bin/${targetPrefix}install_name_tool"
+
+      wrap \
+        ${targetPrefix}strip ${./darwin-strip-wrapper.sh} \
+        "${bintools_bin}/bin/${targetPrefix}strip"
+    ''
+
     ##
     ## Extra custom steps
     ##

pkgs/build-support/bintools-wrapper/ld-wrapper.sh

@@ -102,6 +102,8 @@ declare -a libDirs
 declare -A libs
 declare -i relocatable=0 link32=0
 
+linkerOutput="a.out"
+
 if
     [ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 ] \
         || [ "$NIX_SET_BUILD_ID_@suffixSalt@" = 1 ] \
@@ -153,6 +155,24 @@ then
     done
 fi
 
+# Determine linkerOutput
+prev=
+for p in \
+    ${extraBefore+"${extraBefore[@]}"} \
+    ${params+"${params[@]}"} \
+    ${extraAfter+"${extraAfter[@]}"}
+do
+    case "$prev" in
+        -o)
+            # Informational for post-link-hook
+            linkerOutput="$p"
+            ;;
+        *)
+            ;;
+    esac
+    prev="$p"
+done
+
 if [[ "$link32" = "1" && "$setDynamicLinker" = 1 && -e "@out@/nix-support/dynamic-linker-m32" ]]; then
     # We have an alternate 32-bit linker and we're producing a 32-bit ELF, let's
     # use it.
@@ -223,7 +243,11 @@ fi
 
 PATH="$path_backup"
 # Old bash workaround, see above.
-exec @prog@ \
+@prog@ \
     ${extraBefore+"${extraBefore[@]}"} \
     ${params+"${params[@]}"} \
     ${extraAfter+"${extraAfter[@]}"}
+
+if [ -e "@out@/nix-support/post-link-hook" ]; then
+    source @out@/nix-support/post-link-hook
+fi

pkgs/build-support/nuke-references/builder.sh

@@ -1,29 +0,0 @@
-source $stdenv/setup
-
-mkdir -p $out/bin
-cat > $out/bin/nuke-refs <<EOF
-#! $SHELL -e
-
-excludes=""
-while getopts e: o; do
-    case "\$o" in
-        e) storeId=\$(echo "\$OPTARG" | $perl/bin/perl -ne "print \"\\\$1\" if m|^\Q$NIX_STORE\E/([a-z0-9]{32})-.*|")
-           if [ -z "\$storeId" ]; then
-               echo "-e argument must be a Nix store path"
-               exit 1
-           fi
-           excludes="\$excludes(?!\$storeId)"
-        ;;
-    esac
-done
-shift \$((\$OPTIND-1))
-
-for i in "\$@"; do
-    if test ! -L "\$i" -a -f "\$i"; then
-        cat "\$i" | $perl/bin/perl -pe "s|\Q$NIX_STORE\E/\$excludes[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "\$i.tmp"
-        if test -x "\$i"; then chmod +x "\$i.tmp"; fi
-        mv "\$i.tmp" "\$i"
-    fi
-done
-EOF
-chmod +x $out/bin/nuke-refs

pkgs/build-support/nuke-references/darwin-sign-fixup.sh

@@ -0,0 +1,5 @@
+# Fixup hook for nukeReferences, not stdenv
+
+source @signingUtils@
+
+fixupHooks+=(signIfRequired)

pkgs/build-support/nuke-references/default.nix

@@ -3,11 +3,35 @@
 # path (/nix/store/eeee...).  This is useful for getting rid of
 # dependencies that you know are not actually needed at runtime.
 
-{ stdenvNoCC, perl }:
+{ lib, stdenvNoCC, perl, signingUtils, shell ? stdenvNoCC.shell }:
+
+let
+  stdenv = stdenvNoCC;
+
+  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
+in
 
 stdenvNoCC.mkDerivation {
   name = "nuke-references";
-  builder = ./builder.sh;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    substituteAll ${./nuke-refs.sh} $out/bin/nuke-refs
+    chmod a+x $out/bin/nuke-refs
+  '';
+
+  postFixup = lib.optionalString darwinCodeSign ''
+    mkdir -p $out/nix-support
+    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
+  '';
+
   # FIXME: get rid of perl dependency.
   inherit perl;
+  inherit (builtins) storeDir;
+  shell = lib.getBin shell + (shell.shellPath or "");
+  signingUtils = if darwinCodeSign then signingUtils else null;
 }

pkgs/build-support/nuke-references/nuke-refs.sh

@@ -0,0 +1,33 @@
+#! @shell@
+
+fixupHooks=()
+
+if [ -e @out@/nix-support/setup-hooks.sh ]; then
+    source @out@/nix-support/setup-hooks.sh
+fi
+
+excludes=""
+while getopts e: o; do
+    case "$o" in
+        e) storeId=$(echo "$OPTARG" | @perl@/bin/perl -ne "print \"\$1\" if m|^\Q@storeDir@\E/([a-z0-9]{32})-.*|")
+           if [ -z "$storeId" ]; then
+               echo "-e argument must be a Nix store path"
+               exit 1
+           fi
+           excludes="$excludes(?!$storeId)"
+        ;;
+    esac
+done
+shift $(($OPTIND-1))
+
+for i in "$@"; do
+    if test ! -L "$i" -a -f "$i"; then
+        cat "$i" | @perl@/bin/perl -pe "s|\Q@storeDir@\E/$excludes[a-z0-9]{32}-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "$i.tmp"
+        if test -x "$i"; then chmod +x "$i.tmp"; fi
+        mv "$i.tmp" "$i"
+
+        for hook in "${fixupHooks[@]}"; do
+            eval "$hook" "$i"
+        done
+    fi
+done

pkgs/build-support/remove-references-to/darwin-sign-fixup.sh

@@ -0,0 +1,5 @@
+# Fixup hook for nukeReferences, not stdenv
+
+source @signingUtils@
+
+fixupHooks+=(signIfRequired)

pkgs/build-support/remove-references-to/default.nix

@@ -3,32 +3,33 @@
 # non-existent path (/nix/store/eeee...).  This is useful for getting rid of
 # dependencies that you know are not actually needed at runtime.
 
-{ stdenv, writeScriptBin }:
+{ lib, stdenvNoCC, signingUtils, shell ? stdenvNoCC.shell }:
 
-writeScriptBin "remove-references-to" ''
+let
-#! ${stdenv.shell} -e
+  stdenv = stdenvNoCC;
 
-# References to remove
+  darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
-targets=()
+in
-while getopts t: o; do
-    case "$o" in
-        t) storeId=$(echo "$OPTARG" | sed -n "s|^$NIX_STORE/\\([a-z0-9]\{32\}\\)-.*|\1|p")
-           if [ -z "$storeId" ]; then
-               echo "-t argument must be a Nix store path"
-               exit 1
-           fi
-           targets+=("$storeId")
-    esac
-done
-shift $(($OPTIND-1))
 
-# Files to remove the references from
+stdenv.mkDerivation {
-regions=()
+  name = "remove-references-to";
-for i in "$@"; do
-    test ! -L "$i" -a -f "$i" && regions+=("$i")
-done
 
-for target in "''${targets[@]}" ; do
+  dontUnpack = true;
-    sed -i -e "s|$NIX_STORE/$target-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "''${regions[@]}"
+  dontConfigure = true;
-done
+  dontBuild = true;
-''
+
+  installPhase = ''
+    mkdir -p $out/bin
+    substituteAll ${./remove-references-to.sh} $out/bin/remove-references-to
+    chmod a+x $out/bin/remove-references-to
+  '';
+
+  postFixup = lib.optionalString darwinCodeSign ''
+    mkdir -p $out/nix-support
+    substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
+  '';
+
+  inherit (builtins) storeDir;
+  shell = lib.getBin shell + (shell.shellPath or "");
+  signingUtils = if darwinCodeSign then signingUtils else null;
+}

pkgs/build-support/remove-references-to/remove-references-to.sh

@@ -0,0 +1,37 @@
+#! @shell@ -e
+
+fixupHooks=()
+
+if [ -e @out@/nix-support/setup-hooks.sh ]; then
+    source @out@/nix-support/setup-hooks.sh
+fi
+
+# References to remove
+targets=()
+while getopts t: o; do
+    case "$o" in
+        t) storeId=$(echo "$OPTARG" | sed -n "s|^@storeDir@/\\([a-z0-9]\{32\}\\)-.*|\1|p")
+           if [ -z "$storeId" ]; then
+               echo "-t argument must be a Nix store path"
+               exit 1
+           fi
+           targets+=("$storeId")
+    esac
+done
+shift $(($OPTIND-1))
+
+# Files to remove the references from
+regions=()
+for i in "$@"; do
+    test ! -L "$i" -a -f "$i" && regions+=("$i")
+done
+
+for target in "${targets[@]}" ; do
+    sed -i -e "s|@storeDir@/$target-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" "${regions[@]}"
+done
+
+for region in "${regions[@]}"; do
+    for hook in "${fixupHooks[@]}"; do
+        eval "$hook" "$i"
+    done
+done

pkgs/build-support/setup-hooks/fix-darwin-dylib-names.sh

@@ -23,7 +23,7 @@ fixDarwinDylibNames() {
     for fn in "$@"; do
         if [ -L "$fn" ]; then continue; fi
         echo "$fn: fixing dylib"
-        int_out=$(install_name_tool -id "$fn" "${flags[@]}" "$fn" 2>&1)
+        int_out=$(@targetPrefix@install_name_tool -id "$fn" "${flags[@]}" "$fn" 2>&1)
         result=$?
         if [ "$result" -ne 0 ] &&
             ! grep "shared library stub file and can't be changed" <<< "$out"

pkgs/development/compilers/llvm/11/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, fetch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
+{ lib, stdenv, llvm_meta, fetch, fetchpatch, cmake, libxml2, libllvm, version, clang-tools-extra_src, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -45,6 +45,18 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      # Revert: [Driver] Default to -fno-common for all targets
+      # https://reviews.llvm.org/D75056
+      #
+      # Maintains compatibility with packages that haven't been fixed yet, and
+      # matches gcc10's configuration in nixpkgs.
+      (fetchpatch {
+        revert = true;
+        url = "https://github.com/llvm/llvm-project/commit/0a9fc9233e172601e26381810d093e02ef410f65.diff";
+        stripLen = 1;
+        excludes = [ "docs/*" "test/*" ];
+        sha256 = "0gxgmi0qbm89mq911dahallhi8m6wa9vpklklqmxafx4rplrr8ph";
+      })
     ];
 
     postPatch = ''

pkgs/development/compilers/llvm/11/compiler-rt/default.nix

@@ -3,6 +3,7 @@
 let
 
   useLLVM = stdenv.hostPlatform.useLLVM or false;
+  isDarwin = stdenv.hostPlatform.isDarwin;
   bareMetal = stdenv.hostPlatform.parsed.kernel.name == "none";
   haveLibc = stdenv.cc.libc != null;
   inherit (stdenv.hostPlatform) isMusl;
@@ -15,7 +16,6 @@ stdenv.mkDerivation {
   src = fetch "compiler-rt" "0x1j8ngf1zj63wlnns9vlibafq48qcm72p4jpaxkmkb4qw0grwfy";
 
   nativeBuildInputs = [ cmake python3 llvm.dev ];
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin libcxxabi;
 
   NIX_CFLAGS_COMPILE = [
     "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0"
@@ -25,19 +25,19 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
+  ] ++ lib.optionals (useLLVM || isDarwin || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
     "-DCOMPILER_RT_BUILD_XRAY=OFF"
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
     "-DCOMPILER_RT_BUILD_PROFILE=OFF"
-  ] ++ lib.optionals ((useLLVM || bareMetal) && !haveLibc) [
+  ] ++ lib.optionals ((useLLVM || isDarwin || bareMetal) && !haveLibc) [
     "-DCMAKE_C_COMPILER_WORKS=ON"
     "-DCMAKE_CXX_COMPILER_WORKS=ON"
     "-DCOMPILER_RT_BAREMETAL_BUILD=ON"
     "-DCMAKE_SIZEOF_VOID_P=${toString (stdenv.hostPlatform.parsed.cpu.bits / 8)}"
-  ] ++ lib.optionals (useLLVM && !haveLibc) [
+  ] ++ lib.optionals ((useLLVM || isDarwin) && !haveLibc) [
     "-DCMAKE_C_FLAGS=-nodefaultlibs"
-  ] ++ lib.optionals (useLLVM) [
+  ] ++ lib.optionals (useLLVM || isDarwin) [
     "-DCOMPILER_RT_BUILD_BUILTINS=ON"
     #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
     "-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY"
@@ -61,6 +61,11 @@ stdenv.mkDerivation {
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
+
+  preConfigure = lib.optionalString isDarwin ''
+    cmakeFlagsArray+=("-DCMAKE_LIPO=$(command -v ${stdenv.cc.targetPrefix}lipo)")
+  '';
+
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks
   # to get it, but they're unfree. Since LLVM is rather central to the stdenv, we patch out TSAN support so that Hydra
   # can build this. If we didn't do it, basically the entire nixpkgs on Darwin would have an unfree dependency and we'd
@@ -71,7 +76,7 @@ stdenv.mkDerivation {
       --replace 'set(X86 i386)' 'set(X86 i386 i486 i586 i686)'
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace cmake/builtin-config-ix.cmake \
-      --replace 'set(ARM64 arm64 arm64e)' 'set(ARM64)'
+      --replace 'foreach(arch ''${ARM64})' 'foreach(arch)'
     substituteInPlace cmake/config-ix.cmake \
       --replace 'set(COMPILER_RT_HAS_TSAN TRUE)' 'set(COMPILER_RT_HAS_TSAN FALSE)'
   '' + lib.optionalString (useLLVM) ''

pkgs/development/compilers/llvm/11/default.nix

@@ -213,20 +213,20 @@ let
 
     compiler-rt-libc = callPackage ./compiler-rt {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || stdenv.hostPlatform.isDarwin
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRtWithLibc
                else stdenv;
     };
 
     compiler-rt-no-libc = callPackage ./compiler-rt {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || stdenv.hostPlatform.isDarwin
                then overrideCC stdenv buildLlvmTools.clangNoCompilerRt
                else stdenv;
     };
 
     # N.B. condition is safe because without useLLVM both are the same.
-    compiler-rt = if stdenv.hostPlatform.isAndroid
+    compiler-rt = if stdenv.hostPlatform.isAndroid || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
       then libraries.compiler-rt-libc
       else libraries.compiler-rt-no-libc;
 
@@ -236,21 +236,21 @@ let
 
     libcxx = callPackage ./libcxx {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || stdenv.hostPlatform.isDarwin
                then overrideCC stdenv buildLlvmTools.clangNoLibcxx
                else stdenv;
     };
 
     libcxxabi = callPackage ./libcxxabi {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || stdenv.hostPlatform.isDarwin
                then overrideCC stdenv buildLlvmTools.clangNoLibcxx
                else stdenv;
     };
 
     libunwind = callPackage ./libunwind {
       inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+      stdenv = if (stdenv.hostPlatform.useLLVM or false) || stdenv.hostPlatform.isDarwin
                then overrideCC stdenv buildLlvmTools.clangNoLibcxx
                else stdenv;
     };

pkgs/development/compilers/llvm/11/libcxx/default.nix

@@ -46,7 +46,20 @@ stdenv.mkDerivation {
       "-DLIBCXX_ENABLE_THREADS=OFF"
       "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
       "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
-    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";
+    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF"
+
+    # TODO: this is a bit of a hack to cross compile to Apple Silicon.  libcxx
+    # starting with 11 enables CMAKE_BUILD_WITH_INSTALL_NAME_DIR which requires
+    # platform setup for rpaths. In cmake, this is enabled when macos is newer
+    # than 10.5. However CMAKE_SYSTEM_VERSION is set to empty (TODO: why?)
+    # which prevents the conditional configuration, and configure fails.  The
+    # value here corresponds to `uname -r`. If stdenv.hostPlatform.release is
+    # not null, then this property will be set via mkDerivation (TODO: how can
+    # we set this?).
+    ++ lib.optional (
+      stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 &&
+      stdenv.hostPlatform != stdenv.buildPlatform
+    ) "-DCMAKE_SYSTEM_VERSION=20.1.0";
 
   passthru = {
     isLLVM = true;

pkgs/development/compilers/llvm/11/libcxxabi/default.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation {
         # the magic combination of necessary CMake variables
         # if you fancy a try, take a look at
         # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
+        ${stdenv.cc.targetPrefix}install_name_tool -id $out/$file $file
       done
       make install
       install -d 755 $out/include

pkgs/development/compilers/sbcl/2.0.8.nix

@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "2.0.8";
+  version = "2.1.2";
-  sha256 = "1xwrwvps7drrpyw3wg5h3g2qajmkwqs9gz0fdw1ns9adp7vld390";
+  sha256 = "sha256-t3EFUJOYVe1JWYxKAUSD7RILaZFliio7avpHcT3OTAs=";
 }

pkgs/development/compilers/sbcl/bootstrap.nix

@@ -2,6 +2,11 @@
 
 let
   options = rec {
+    aarch64-darwin = {
+      version = "2.1.2";
+      system = "arm64-darwin";
+      sha256 = "sha256-H0ALigXcWIypdA+fTf7jERscwbb7QIAfcoxCtGDh0RU=";
+    };
     x86_64-darwin = {
       version = "1.2.11";
       system = "x86-64-darwin";

pkgs/development/compilers/sbcl/common.nix

@@ -2,7 +2,7 @@
 
 { lib, stdenv, fetchurl, writeText, sbclBootstrap
 , sbclBootstrapHost ? "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
-, threadSupport ? (stdenv.isi686 || stdenv.isx86_64 || "aarch64-linux" == stdenv.hostPlatform.system)
+, threadSupport ? (stdenv.isi686 || stdenv.isx86_64 || "aarch64-linux" == stdenv.hostPlatform.system || "aarch64-darwin" == stdenv.hostPlatform.system)
 , disableImmobileSpace ? false
   # Meant for sbcl used for creating binaries portable to non-NixOS via save-lisp-and-die.
   # Note that the created binaries still need `patchelf --set-interpreter ...`
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
                   lib.concatStringsSep " "
                     (builtins.map (x: "--with-${x}") enableFeatures ++
                      builtins.map (x: "--without-${x}") disableFeatures)
-                }
+                } ${if stdenv.hostPlatform.system == "aarch64-darwin" then "--arch=arm64" else ""}
     (cd doc/manual ; make info)
 
     runHook postBuild

pkgs/development/libraries/apr/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   name = "apr-1.7.0";
@@ -36,6 +36,10 @@ stdenv.mkDerivation rec {
 
   CPPFLAGS=lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) "-DAPR_IOVEC_DEFINED";
 
+  nativeBuildInputs =
+    # Update libtool for macOS 11 support
+    lib.optional (stdenv.isDarwin && stdenv.isAarch64) [ autoreconfHook ];
+
   enableParallelBuilding = true;
 
   meta = with lib; {

pkgs/development/libraries/catch/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "catch";
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   cmakeFlags = [ "-DUSE_CPP14=ON" ];
 
+  patches = [
+    # https://github.com/catchorg/Catch2/pull/2151
+    (fetchpatch {
+      url = "https://github.com/catchorg/Catch2/commit/bb6d08323f23a39eb65dd86671e68f4f5d3f2d6c.patch";
+      sha256 = "1vhbzx84nrhhf9zlbl6h5zmg3r5w5v833ihlswsysb9wp2i4isc5";
+    })
+  ];
+
   doCheck = true;
   checkTarget = "test";
 

pkgs/development/libraries/fontconfig/default.nix

@@ -61,6 +61,11 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/409b37c62780728755c908991c912a6b16f2389c.patch";
       sha256 = "zJFh37QErSAINPGFkFVJyhYRP27BuIN7PIgoDl/PIwI=";
     })
+
+    # Combination of
+    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/88
+    # https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/131
+    ./macos-atomics.h
   ];
 
   outputs = [ "bin" "dev" "lib" "out" ]; # $out contains all the config

pkgs/development/libraries/fontconfig/macos-atomics.h

@@ -0,0 +1,39 @@
+--- a/src/fcatomic.h	2020-11-27 13:23:44.000000000 +0900
++++ b/src/fcatomic.h	2020-11-27 13:24:43.000000000 +0900
+@@ -70,24 +70,25 @@
+ #elif !defined(FC_NO_MT) && defined(__APPLE__)
+ 
+ #include <libkern/OSAtomic.h>
+-#ifdef __MAC_OS_X_MIN_REQUIRED
+ #include <AvailabilityMacros.h>
+-#elif defined(__IPHONE_OS_MIN_REQUIRED)
+-#include <Availability.h>
+-#endif
+ 
+ typedef int fc_atomic_int_t;
+ #define fc_atomic_int_add(AI, V)	(OSAtomicAdd32Barrier ((V), &(AI)) - (V))
+ 
+-#define fc_atomic_ptr_get(P)		(OSMemoryBarrier (), (void *) *(P))
+-#if (MAC_OS_X_VERSION_MIN_REQUIRED > MAC_OS_X_VERSION_10_4 || __IPHONE_VERSION_MIN_REQUIRED >= 20100)
+-#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwapPtrBarrier ((void *) (O), (void *) (N), (void **) (P))
+-#else
+-#if __ppc64__ || __x86_64__
+-#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwap64Barrier ((int64_t) (O), (int64_t) (N), (int64_t*) (P))
++#if (MAC_OS_X_VERSION_MIN_REQUIRED > MAC_OS_X_VERSION_10_4 || __IPHONE_OS_VERSION_MIN_REQUIRED >= 20100)
++
++#if SIZEOF_VOID_P == 8
++#define fc_atomic_ptr_get(P)		OSAtomicAdd64Barrier (0, (int64_t*)(P))
++#elif SIZEOF_VOID_P == 4
++#define fc_atomic_ptr_get(P)		OSAtomicAdd32Barrier (0, (int32_t*)(P))
+ #else
+-#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwap32Barrier ((int32_t) (O), (int32_t) (N), (int32_t*) (P))
++#error "SIZEOF_VOID_P not 4 or 8 (assumes CHAR_BIT is 8)"
+ #endif
++
++#define fc_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwapPtrBarrier ((void *) (O), (void *) (N), (void **) (P))
++
++#else
++#error "Your macOS / iOS targets are too old"
+ #endif
+ 
+ #elif !defined(FC_NO_MT) && defined(HAVE_INTEL_ATOMIC_PRIMITIVES)

pkgs/development/libraries/glib/default.nix

@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   patches = optionals stdenv.isDarwin [
     ./darwin-compilation.patch
+    ./link-with-coreservices.patch
   ] ++ optionals stdenv.hostPlatform.isMusl [
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch

pkgs/development/libraries/glib/link-with-coreservices.patch

@@ -0,0 +1,11 @@
+--- a/meson.build.orig	2020-11-25 13:47:38.499149252 +0900
++++ b/meson.build	2020-11-25 13:48:47.098444800 +0900
+@@ -742,7 +742,7 @@
+ 
+   if glib_have_carbon
+     glib_conf.set('HAVE_CARBON', true)
+-    osx_ldflags += '-Wl,-framework,Carbon'
++    osx_ldflags += ['-Wl,-framework,Carbon', '-Wl,-framework,CoreServices']
+     glib_have_os_x_9_or_later = objcc.compiles('''#include <AvailabilityMacros.h>
+                                                   #if MAC_OS_X_VERSION_MIN_REQUIRED < 1090
+                                                   #error Compiling for minimum OS X version before 10.9

pkgs/development/libraries/gmp/6.x.nix

@@ -46,7 +46,7 @@ let self = stdenv.mkDerivation rec {
     # to build a .dll on windows, we need --disable-static + --enable-shared
     # see https://gmplib.org/manual/Notes-for-Particular-Systems.html
     ++ optional (!withStatic && stdenv.hostPlatform.isWindows) "--disable-static --enable-shared"
-    ;
+    ++ optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) "--disable-assembly";
 
   doCheck = true; # not cross;
 

pkgs/development/libraries/libevent/default.nix

@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
     sha256 = "1fq30imk8zd26x8066di3kpc5zyfc5z6frr3zll685zcx4dxxrlj";
   };
 
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
   # libevent_openssl is moved into its own output, so that openssl isn't present
   # in the default closure.
   outputs = [ "out" "dev" ]

pkgs/development/libraries/libxml2/default.nix

@@ -3,7 +3,7 @@
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt"
-, enableStatic ? !enableShared,
+, enableStatic ? !enableShared
 }:
 
 stdenv.mkDerivation rec {
@@ -53,6 +53,10 @@ stdenv.mkDerivation rec {
     (lib.withFeatureAs pythonSupport "python" python)
   ];
 
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
   enableParallelBuilding = true;
 
   # disable test that's problematic with newer pythons: see

pkgs/development/libraries/openbsm/default.nix

@@ -13,6 +13,10 @@ stdenv.mkDerivation rec {
 
   patches = lib.optional stdenv.isDarwin [ ./bsm-add-audit_token_to_pid.patch ];
 
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
   configureFlags = [ "ac_cv_file__usr_include_mach_audit_triggers_defs=no" ];
 
   meta = {

pkgs/development/libraries/openldap/default.nix

@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
   configureFlags = [
     "--enable-overlays"
     "--disable-dependency-tracking"   # speeds up one-time build

pkgs/development/libraries/openssl/default.nix

@@ -69,6 +69,7 @@ let
         armv6l-linux = "./Configure linux-armv4 -march=armv6";
         armv7l-linux = "./Configure linux-armv4 -march=armv7-a";
         x86_64-darwin  = "./Configure darwin64-x86_64-cc";
+        aarch64-darwin = "./Configure darwin64-arm64-cc";
         x86_64-linux = "./Configure linux-x86_64";
         x86_64-solaris = "./Configure solaris64-x86_64-gcc";
       }.${stdenv.hostPlatform.system} or (

pkgs/development/libraries/pcre/default.nix

@@ -23,7 +23,8 @@ in stdenv.mkDerivation {
 
   outputs = [ "bin" "dev" "out" "doc" "man" ];
 
-  configureFlags = optional (!stdenv.hostPlatform.isRiscV) "--enable-jit" ++ [
+  # Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
+  configureFlags = optional (!stdenv.hostPlatform.isRiscV && !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--enable-jit" ++ [
     "--enable-unicode-properties"
     "--disable-cpp"
   ]

pkgs/development/libraries/pcre2/default.nix

@@ -8,10 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0p3699msps07p40g9426lvxa3b41rg7k2fn7qxl2jm0kh4kkkvx9";
   };
 
+  # Disable jit on Apple Silicon, https://github.com/zherczeg/sljit/issues/51
   configureFlags = [
     "--enable-pcre2-16"
     "--enable-pcre2-32"
-  ] ++ lib.optional (!stdenv.hostPlatform.isRiscV) "--enable-jit";
+  ] ++ lib.optional (!stdenv.hostPlatform.isRiscV && !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--enable-jit";
 
   outputs = [ "bin" "dev" "out" "doc" "man" "devdoc" ];
 

pkgs/development/libraries/zlib/default.nix

@@ -37,8 +37,8 @@ stdenv.mkDerivation (rec {
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace configure \
-      --replace '/usr/bin/libtool' 'ar' \
+      --replace '/usr/bin/libtool' '${stdenv.cc.targetPrefix}ar' \
-      --replace 'AR="libtool"' 'AR="ar"' \
+      --replace 'AR="libtool"' 'AR="${stdenv.cc.targetPrefix}ar"' \
       --replace 'ARFLAGS="-o"' 'ARFLAGS="-r"'
   '';
 

pkgs/development/python-modules/cryptography/default.nix

@@ -66,8 +66,18 @@ buildPythonPackage rec {
     pytz
   ];
 
+  pytestFlags = lib.concatStringsSep " " ([
+    "--disable-pytest-warnings"
+  ] ++
+    lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+      # aarch64-darwin forbids W+X memory, but this tests depends on it:
+      # * https://cffi.readthedocs.io/en/latest/using.html#callbacks
+      "--ignore=tests/hazmat/backends/test_openssl_memleak.py"
+    ]
+  );
+
   checkPhase = ''
-    py.test --disable-pytest-warnings tests
+    py.test ${pytestFlags} tests
   '';
 
   # IOKit's dependencies are inconsistent between OSX versions, so this is the best we

pkgs/development/tools/misc/ctags/default.nix

@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
   # don't use $T(E)MP which is set to the build directory
   configureFlags= [ "--enable-tmpdir=/tmp" ];
 
+  patches = [
+    # Library defines an `__unused__` which is a reserved name, and may
+    # conflict with the standard library definition. One such conflict is with
+    # macOS headers.
+    ./unused-collision.patch
+  ];
+
   meta = with lib; {
     description = "A tool for fast source code browsing (exuberant ctags)";
     longDescription = ''

pkgs/development/tools/misc/ctags/unused-collision.patch

@@ -0,0 +1,246 @@
+--- a/c.c	(revision 816)
++++ b/c.c	(working copy)
+@@ -619,7 +619,7 @@
+ 	return name;
+ }
+ 
+-static void __unused__ pt (tokenInfo *const token)
++static void UNUSED pt (tokenInfo *const token)
+ {
+ 	if (isType (token, TOKEN_NAME))
+ 		printf ("type: %-12s: %-13s   line: %lu\n",
+@@ -634,7 +634,7 @@
+ 			tokenString (token->type), token->lineNumber);
+ }
+ 
+-static void __unused__ ps (statementInfo *const st)
++static void UNUSED ps (statementInfo *const st)
+ {
+ 	unsigned int i;
+ 	printf ("scope: %s   decl: %s   gotName: %s   gotParenName: %s\n",
+--- a/eiffel.c	(revision 816)
++++ b/eiffel.c	(working copy)
+@@ -807,7 +807,7 @@
+ 
+ static boolean parseType (tokenInfo *const token);
+ 
+-static void parseGeneric (tokenInfo *const token, boolean declaration __unused__)
++static void parseGeneric (tokenInfo *const token, boolean declaration UNUSED)
+ {
+ 	unsigned int depth = 0;
+ #ifdef TYPE_REFERENCE_TOOL
+--- a/general.h	(revision 816)
++++ b/general.h	(working copy)
+@@ -57,10 +57,10 @@
+  *  to prevent warnings about unused variables.
+  */
+ #if (__GNUC__ > 2  ||  (__GNUC__ == 2  &&  __GNUC_MINOR__ >= 7)) && !defined (__GNUG__)
+-# define __unused__  __attribute__((unused))
++# define UNUSED  __attribute__((unused))
+ # define __printf__(s,f)  __attribute__((format (printf, s, f)))
+ #else
+-# define __unused__
++# define UNUSED
+ # define __printf__(s,f)
+ #endif
+ 
+--- a/lregex.c	(revision 816)
++++ b/lregex.c	(working copy)
+@@ -538,11 +538,11 @@
+ #endif  /* HAVE_REGEX */
+ 
+ extern void addTagRegex (
+-		const langType language __unused__,
+-		const char* const regex __unused__,
+-		const char* const name __unused__,
+-		const char* const kinds __unused__,
+-		const char* const flags __unused__)
++		const langType language UNUSED,
++		const char* const regex UNUSED,
++		const char* const name UNUSED,
++		const char* const kinds UNUSED,
++		const char* const flags UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	Assert (regex != NULL);
+@@ -564,10 +564,10 @@
+ }
+ 
+ extern void addCallbackRegex (
+-		const langType language __unused__,
+-		const char* const regex __unused__,
+-		const char* const flags __unused__,
+-		const regexCallback callback __unused__)
++		const langType language UNUSED,
++		const char* const regex UNUSED,
++		const char* const flags UNUSED,
++		const regexCallback callback UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	Assert (regex != NULL);
+@@ -581,7 +581,7 @@
+ }
+ 
+ extern void addLanguageRegex (
+-		const langType language __unused__, const char* const regex __unused__)
++		const langType language UNUSED, const char* const regex UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	if (! regexBroken)
+@@ -602,7 +602,7 @@
+ */
+ 
+ extern boolean processRegexOption (const char *const option,
+-								   const char *const parameter __unused__)
++								   const char *const parameter UNUSED)
+ {
+ 	boolean handled = FALSE;
+ 	const char* const dash = strchr (option, '-');
+@@ -624,7 +624,7 @@
+ 	return handled;
+ }
+ 
+-extern void disableRegexKinds (const langType language __unused__)
++extern void disableRegexKinds (const langType language UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	if (language <= SetUpper  &&  Sets [language].count > 0)
+@@ -639,8 +639,8 @@
+ }
+ 
+ extern boolean enableRegexKind (
+-		const langType language __unused__,
+-		const int kind __unused__, const boolean mode __unused__)
++		const langType language UNUSED,
++		const int kind UNUSED, const boolean mode UNUSED)
+ {
+ 	boolean result = FALSE;
+ #ifdef HAVE_REGEX
+@@ -660,7 +660,7 @@
+ 	return result;
+ }
+ 
+-extern void printRegexKinds (const langType language __unused__, boolean indent __unused__)
++extern void printRegexKinds (const langType language UNUSED, boolean indent UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	if (language <= SetUpper  &&  Sets [language].count > 0)
+--- a/lua.c	(revision 816)
++++ b/lua.c	(working copy)
+@@ -37,7 +37,7 @@
+ */
+ 
+ /* for debugging purposes */
+-static void __unused__ print_string (char *p, char *q)
++static void UNUSED print_string (char *p, char *q)
+ {
+ 	for ( ; p != q; p++)
+ 		fprintf (errout, "%c", *p);
+--- a/main.c	(revision 816)
++++ b/main.c	(working copy)
+@@ -522,7 +522,7 @@
+  *		Start up code
+  */
+ 
+-extern int main (int __unused__ argc, char **argv)
++extern int main (int UNUSED argc, char **argv)
+ {
+ 	cookedArgs *args;
+ #ifdef VMS
+--- a/options.c	(revision 816)
++++ b/options.c	(working copy)
+@@ -730,7 +730,7 @@
+ }
+ 
+ static void processExcludeOption (
+-		const char *const option __unused__, const char *const parameter)
++		const char *const option UNUSED, const char *const parameter)
+ {
+ 	const char *const fileName = parameter + 1;
+ 	if (parameter [0] == '\0')
+@@ -867,7 +867,7 @@
+ }
+ 
+ static void processFilterTerminatorOption (
+-		const char *const option __unused__, const char *const parameter)
++		const char *const option UNUSED, const char *const parameter)
+ {
+ 	freeString (&Option.filterTerminator);
+ 	Option.filterTerminator = stringCopy (parameter);
+@@ -930,8 +930,8 @@
+ }
+ 
+ static void processHelpOption (
+-		const char *const option __unused__,
+-		const char *const parameter __unused__)
++		const char *const option UNUSED,
++		const char *const parameter UNUSED)
+ {
+ 	printProgramIdentification ();
+ 	putchar ('\n');
+@@ -1139,8 +1139,8 @@
+ }
+ 
+ static void processLicenseOption (
+-		const char *const option __unused__,
+-		const char *const parameter __unused__)
++		const char *const option UNUSED,
++		const char *const parameter UNUSED)
+ {
+ 	printProgramIdentification ();
+ 	puts ("");
+@@ -1166,8 +1166,8 @@
+ }
+ 
+ static void processListMapsOption (
+-		const char *const __unused__ option,
+-		const char *const __unused__ parameter)
++		const char *const UNUSED option,
++		const char *const UNUSED parameter)
+ {
+ 	if (parameter [0] == '\0' || strcasecmp (parameter, "all") == 0)
+ 	    printLanguageMaps (LANG_AUTO);
+@@ -1183,8 +1183,8 @@
+ }
+ 
+ static void processListLanguagesOption (
+-		const char *const option __unused__,
+-		const char *const parameter __unused__)
++		const char *const option UNUSED,
++		const char *const parameter UNUSED)
+ {
+ 	printLanguageList ();
+ 	exit (0);
+@@ -1358,8 +1358,8 @@
+ }
+ 
+ static void processVersionOption (
+-		const char *const option __unused__,
+-		const char *const parameter __unused__)
++		const char *const option UNUSED,
++		const char *const parameter UNUSED)
+ {
+ 	printProgramIdentification ();
+ 	exit (0);
+--- a/parse.c	(revision 816)
++++ b/parse.c	(working copy)
+@@ -376,7 +376,7 @@
+ */
+ 
+ extern void processLanguageDefineOption (
+-		const char *const option, const char *const parameter __unused__)
++		const char *const option, const char *const parameter UNUSED)
+ {
+ #ifdef HAVE_REGEX
+ 	if (parameter [0] == '\0')
+--- a/routines.c	(revision 816)
++++ b/routines.c	(working copy)
+@@ -526,7 +526,7 @@
+ 
+ #if ! defined (HAVE_STAT_ST_INO)
+ 
+-static void canonicalizePath (char *const path __unused__)
++static void canonicalizePath (char *const path UNUSED)
+ {
+ #if defined (MSDOS_STYLE_PATH)
+ 	char *p;

pkgs/development/tools/misc/libtool/libtool2-macos11.patch

@@ -0,0 +1,32 @@
+Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
+---
+ m4/libtool.m4 | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/m4/libtool.m4 b/m4/libtool.m4
+index f2d1f398..b971e8e7 100644
+--- a/m4/libtool.m4
++++ b/m4/libtool.m4
+@@ -1067,16 +1067,11 @@ _LT_EOF
+       _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
+     darwin1.*)
+       _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+-    darwin*) # darwin 5.x on
+-      # if running on 10.5 or later, the deployment target defaults
+-      # to the OS version, if on x86, and 10.4, the deployment
+-      # target defaults to 10.4. Don't you love it?
+-      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
+-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
+-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+-	10.[[012]][[,.]]*)
++    darwin*)
++      case ${MACOSX_DEPLOYMENT_TARGET},$host in
++	10.[[012]],*|,*powerpc*)
+ 	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+-	10.*)
++	*)
+ 	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+       esac
+     ;;
+-- 
+2.24.3 (Apple Git-128)

pkgs/development/tools/misc/libtool/libtool2.nix

@@ -1,6 +1,11 @@
-{ lib, stdenv, fetchurl, m4, perl, help2man
+{ lib, stdenv, fetchurl, fetchpatch, autoconf, automake, m4, perl, help2man
 }:
 
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
 stdenv.mkDerivation rec {
   pname = "libtool";
   version = "2.4.6";
@@ -12,7 +17,26 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "lib" ];
 
-  nativeBuildInputs = [ perl help2man m4 ];
+  patches = [
+    # Suport macOS version 11.0
+    # https://lists.gnu.org/archive/html/libtool-patches/2020-06/msg00001.html
+    ./libtool2-macos11.patch
+  ];
+
+  # Normally we'd use autoreconfHook, but that includes libtoolize.
+  postPatch = ''
+    aclocal -I m4
+    automake
+    autoconf
+
+    pushd libltdl
+    aclocal -I ../m4
+    automake
+    autoconf
+    popd
+  '';
+
+  nativeBuildInputs = [ perl help2man m4 ] ++ [ autoconf automake ];
   propagatedBuildInputs = [ m4 ];
 
   # Don't fixup "#! /bin/sh" in Libtool, otherwise it will use the

pkgs/development/tools/parsing/flex/default.nix

@@ -34,8 +34,8 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ m4 ];
 
   preConfigure = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "ac_cv_func_malloc_0_nonnull=yes"
+    "export ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
+    "export ac_cv_func_realloc_0_nonnull=yes"
   ];
 
   postConfigure = lib.optionalString (stdenv.isDarwin || stdenv.isCygwin) ''

pkgs/development/tools/xcbuild/platforms.nix

@@ -1,4 +1,4 @@
-{ runCommand, lib, sdks, xcodePlatform, writeText }:
+{ stdenv, runCommand, lib, sdks, xcodePlatform, writeText }:
 
 let
 
@@ -15,23 +15,23 @@ let
   };
 
   # These files are all based off of Xcode spec fies found in
-  # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/Speciications/.
+  # /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/Library/Xcode/PrivatePlugIns/IDEOSXSupportCore.ideplugin/Contents/Resources.
 
-  # Based off of the MacOSX Architectures.xcpsec file. All i386 stuff
+  # Based off of the "MacOSX Architectures.xcspec" file. All i386 stuff
-  # is removed because NixPkgs only supports darwin-x86_64.
+  # is removed because NixPkgs only supports darwin-x86_64 and darwin-arm64.
   Architectures = [
     {
       Identifier = "Standard";
       Type = "Architecture";
-      Name = "Standard Architectures (64-bit Intel)";
+      Name = "Standard Architectures (Apple Silicon, 64-bit Intel)";
-      RealArchitectures = [ "x86_64" ];
+      RealArchitectures = [ "arm64" "x86_64" ];
       ArchitectureSetting = "ARCHS_STANDARD";
     }
     {
       Identifier = "Universal";
       Type = "Architecture";
-      Name = "Universal (64-bit Intel)";
+      Name = "Universal (Apple Silicon, 64-bit Intel)";
-      RealArchitectures = [ "x86_64" ];
+      RealArchitectures = [ "arm64" "x86_64" ];
       ArchitectureSetting = "ARCHS_STANDARD_32_64_BIT";
     }
     {
@@ -43,25 +43,25 @@ let
     {
       Identifier = "Standard64bit";
       Type = "Architecture";
-      Name = "64-bit Intel";
+      Name = "Apple Silicon, 64-bit Intel";
-      RealArchitectures = [ "x86_64" ];
+      RealArchitectures = [ "arm64" "x86_64" ];
       ArchitectureSetting = "ARCHS_STANDARD_64_BIT";
     }
     {
-      Identifier = "x86_64";
+      Identifier = if stdenv.isAarch64 then "arm64" else "x86_64";
       Type = "Architecture";
-      Name = "Intel 64-bit";
+      Name = "Apple Silicon or Intel 64-bit";
     }
     {
       Identifier = "Standard_Including_64_bit";
       Type = "Architecture";
       Name = "Standard Architectures (including 64-bit)";
-      RealArchitectures = [ "x86_64" ];
+      RealArchitectures = [ "arm64" "x86_64" ];
       ArchitectureSetting = "ARCHS_STANDARD_INCLUDING_64_BIT";
     }
   ];
 
-  # Based off of the MacOSX Package Types.xcpsec file. Only keep the
+  # Based off of the "MacOSX Package Types.xcspec" file. Only keep the
   # bare minimum needed.
   PackageTypes = [
     {
@@ -169,7 +169,7 @@ let
     }
   ];
 
-  # Based off of the MacOSX Product Types.xcpsec file. All
+  # Based off of the "MacOSX Product Types.xcspec" file. All
   # bundles/wrapper are removed, because we prefer dynamic products in
   # NixPkgs.
   ProductTypes = [

pkgs/development/tools/xcbuild/wrapper.nix

@@ -28,7 +28,7 @@ let
   };
 
   platforms = callPackage ./platforms.nix {
-    inherit sdks xcodePlatform;
+    inherit sdks xcodePlatform stdenv;
   };
 
   xcconfig = writeText "nix.xcconfig" ''

pkgs/os-specific/darwin/DarwinTools/default.nix

@@ -8,7 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "0hh4jl590jv3v830p77r3jcrnpndy7p2b8ajai3ldpnx2913jfhp";
   };
 
-  patchPhase = ''
+  patches = [
+    ./sw_vers-CFPriv.patch
+  ];
+
+  postPatch = ''
     substituteInPlace Makefile \
       --replace gcc cc
   '';

pkgs/os-specific/darwin/DarwinTools/sw_vers-CFPriv.patch

@@ -0,0 +1,19 @@
+--- a/sw_vers.c	2021-04-19 13:06:50.131346864 +0900
++++ b/sw_vers.c	2021-04-19 13:07:32.481967474 +0900
+@@ -28,7 +28,15 @@
+  */
+ 
+ #include <CoreFoundation/CoreFoundation.h>
+-#include <CoreFoundation/CFPriv.h>
++
++// Avoid dependency on CoreFoundation/CFPriv, which no longer appears to be
++// part of the upstream sdk.
++
++CFDictionaryRef _CFCopyServerVersionDictionary(void);
++CFDictionaryRef _CFCopySystemVersionDictionary(void);
++extern CFStringRef _kCFSystemVersionProductNameKey;
++extern CFStringRef _kCFSystemVersionProductVersionKey;
++extern CFStringRef _kCFSystemVersionBuildVersionKey;
+ 
+ void usage(char *progname) {
+ 	fprintf(stderr, "Usage: %s [-productName|-productVersion|-buildVersion]\n", progname);

pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix

@@ -0,0 +1,151 @@
+{ lib, stdenvNoCC, buildPackages, fetchurl, xar, cpio, pkgs, python3, pbzx, MacOSX-SDK }:
+
+# TODO: reorganize to make this just frameworks, and move libs to default.nix
+
+let
+  stdenv = stdenvNoCC;
+
+  standardFrameworkPath = name: private:
+    "/System/Library/${lib.optionalString private "Private"}Frameworks/${name}.framework";
+
+  mkDepsRewrites = deps:
+  let
+    mergeRewrites = x: y: {
+      prefix = lib.mergeAttrs (x.prefix or {}) (y.prefix or {});
+      const = lib.mergeAttrs (x.const or {}) (y.const or {});
+    };
+
+    rewriteArgs = { prefix ? {}, const ? {} }: lib.concatLists (
+      (lib.mapAttrsToList (from: to: [ "-p" "${from}:${to}" ]) prefix) ++
+      (lib.mapAttrsToList (from: to: [ "-c" "${from}:${to}" ]) const)
+    );
+
+    rewrites = depList: lib.fold mergeRewrites {}
+      (map (dep: dep.tbdRewrites)
+        (lib.filter (dep: dep ? tbdRewrites) depList));
+  in
+    lib.escapeShellArgs (rewriteArgs (rewrites (builtins.attrValues deps)));
+
+  mkFramework = { name, deps, private ? false }:
+    let self = stdenv.mkDerivation {
+      pname = "apple-${lib.optionalString private "private-"}framework-${name}";
+      version = MacOSX-SDK.version;
+
+      dontUnpack = true;
+
+      # because we copy files from the system
+      preferLocalBuild = true;
+
+      disallowedRequisites = [ MacOSX-SDK ];
+
+      nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+      installPhase = ''
+        mkdir -p $out/Library/Frameworks
+
+        cp -r ${MacOSX-SDK}${standardFrameworkPath name private} $out/Library/Frameworks
+
+        # Fix and check tbd re-export references
+        chmod u+w -R $out
+        find $out -name '*.tbd' -type f | while read tbd; do
+          echo "Fixing re-exports in $tbd"
+          rewrite-tbd \
+            -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+            ${mkDepsRewrites deps} \
+            -r ${builtins.storeDir} \
+            "$tbd"
+        done
+      '';
+
+      propagatedBuildInputs = builtins.attrValues deps;
+
+      passthru = {
+        tbdRewrites = {
+          prefix."${standardFrameworkPath name private}/" = "${self}/Library/Frameworks/${name}.framework/";
+        };
+      };
+
+      meta = with lib; {
+        description = "Apple SDK framework ${name}";
+        maintainers = with maintainers; [ copumpkin ];
+        platforms   = platforms.darwin;
+      };
+    };
+  in self;
+
+  framework = name: deps: mkFramework { inherit name deps; private = false; };
+  privateFramework = name: deps: mkFramework { inherit name deps; private = true; };
+in rec {
+  libs = {
+    xpc = stdenv.mkDerivation {
+      name   = "apple-lib-xpc";
+      dontUnpack = true;
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        cp -r "${MacOSX-SDK}/usr/include/xpc" $out/include/xpc
+        cp "${MacOSX-SDK}/usr/include/launch.h" $out/include/launch.h
+        popd >/dev/null
+      '';
+    };
+
+    Xplugin = stdenv.mkDerivation {
+      name   = "apple-lib-Xplugin";
+      dontUnpack = true;
+
+      propagatedBuildInputs = with frameworks; [
+        OpenGL ApplicationServices Carbon IOKit CoreGraphics CoreServices CoreText
+      ];
+
+      installPhase = ''
+        mkdir -p $out/include $out/lib
+        ln -s "${MacOSX-SDK}/include/Xplugin.h" $out/include/Xplugin.h
+        cp ${MacOSX-SDK}/usr/lib/libXplugin.1.tbd $out/lib
+        ln -s libXplugin.1.tbd $out/lib/libXplugin.tbd
+      '';
+    };
+
+    utmp = stdenv.mkDerivation {
+      name   = "apple-lib-utmp";
+      dontUnpack = true;
+
+      installPhase = ''
+        mkdir -p $out/include
+        pushd $out/include >/dev/null
+        ln -s "${MacOSX-SDK}/include/utmp.h"
+        ln -s "${MacOSX-SDK}/include/utmpx.h"
+        popd >/dev/null
+      '';
+    };
+
+    libDER = stdenv.mkDerivation {
+      name = "apple-lib-libDER";
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/include
+        cp -r ${MacOSX-SDK}/usr/include/libDER $out/include
+      '';
+    };
+  };
+
+  overrides = super: {
+    CoreFoundation = lib.overrideDerivation super.CoreFoundation (drv: {
+      setupHook = ./cf-setup-hook.sh;
+    });
+  };
+
+  bareFrameworks = (
+    lib.mapAttrs framework (import ./frameworks.nix {
+      inherit frameworks libs;
+      inherit (pkgs.darwin) libobjc Libsystem;
+      inherit (pkgs.darwin.apple_sdk) libnetwork;
+    })
+  ) // (
+    lib.mapAttrs privateFramework (import ./private-frameworks.nix {
+      inherit frameworks;
+    })
+  );
+
+  frameworks = bareFrameworks // overrides bareFrameworks;
+}

pkgs/os-specific/darwin/apple-sdk-11.0/cf-setup-hook.sh

@@ -0,0 +1,6 @@
+forceLinkCoreFoundationFramework() {
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
+  NIX_LDFLAGS+=" @out@/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+}
+
+preConfigureHooks+=(forceLinkCoreFoundationFramework)

pkgs/os-specific/darwin/apple-sdk-11.0/default.nix

@@ -0,0 +1,58 @@
+{ stdenvNoCC, fetchurl, newScope, pkgs
+, xar, cpio, python3, pbzx }:
+
+let
+  MacOSX-SDK = stdenvNoCC.mkDerivation rec {
+    pname = "MacOSX-SDK";
+    version = "11.0.0";
+
+    # https://swscan.apple.com/content/catalogs/others/index-10.16.merged-1.sucatalog
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/58/37/001-75138-A_59RXKDS8YM/12ksm19hgzscfc7cau3yhecz4vpkps7wbq/CLTools_macOSNMOS_SDK.pkg";
+      sha256 = "0n51ba926ckwm62w5c8lk3w5hj4ihk0p5j02321qi75wh824hl8m";
+    };
+
+    dontBuild = true;
+    darwinDontCodeSign = true;
+
+    nativeBuildInputs = [ cpio pbzx ];
+
+    outputs = [ "out" ];
+
+    unpackPhase = ''
+      pbzx $src | cpio -idm
+    '';
+
+    installPhase = ''
+      cd Library/Developer/CommandLineTools/SDKs/MacOSX11.0.sdk
+
+      mkdir $out
+      cp -r System usr $out/
+    '';
+
+    passthru = {
+      inherit version;
+    };
+  };
+
+  callPackage = newScope (packages // pkgs.darwin // { inherit MacOSX-SDK; });
+
+  packages = {
+    inherit (callPackage ./apple_sdk.nix {}) frameworks libs;
+
+    # TODO: this is nice to be private. is it worth the callPackage above?
+    # Probably, I don't think that callPackage costs much at all.
+    inherit MacOSX-SDK;
+
+    Libsystem = callPackage ./libSystem.nix {};
+    LibsystemCross = pkgs.darwin.Libsystem;
+    libcharset = callPackage ./libcharset.nix {};
+    libunwind = callPackage ./libunwind.nix {};
+    libnetwork = callPackage ./libnetwork.nix {};
+    objc4 = callPackage ./libobjc.nix {};
+
+    # questionable aliases
+    configd = pkgs.darwin.apple_sdk.frameworks.SystemConfiguration;
+    IOKit = pkgs.darwin.apple_sdk.frameworks.IOKit;
+  };
+in packages

pkgs/os-specific/darwin/apple-sdk-11.0/frameworks.nix

@@ -0,0 +1,193 @@
+{ frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
+{
+  AGL                              = { inherit Carbon OpenGL; };
+  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics; };
+  AVKit                            = {};
+  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
+  Accessibility                    = {};
+  Accounts                         = {};
+  AdSupport                        = {};
+  AddressBook                      = { inherit AddressBookCore Carbon ContactsPersistence libobjc; };
+  AppKit                           = { inherit ApplicationServices AudioToolbox AudioUnit Foundation QuartzCore UIFoundation; };
+  AppTrackingTransparency          = {};
+  AppleScriptKit                   = {};
+  AppleScriptObjC                  = {};
+  ApplicationServices              = { inherit ColorSync CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit AudioToolboxCore CoreAudio CoreMIDI; };
+  AudioUnit                        = { inherit AudioToolbox Carbon CoreAudio; };
+  AudioVideoBridging               = { inherit Foundation; };
+  AuthenticationServices           = {};
+  AutomaticAssessmentConfiguration = {};
+  Automator                        = {};
+  BackgroundTasks                  = {};
+  BusinessChat                     = {};
+  CFNetwork                        = {};
+  CalendarStore                    = {};
+  CallKit                          = {};
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation IOKit QuartzCore Security libobjc; };
+  ClassKit                         = {};
+  CloudKit                         = { inherit CoreLocation; };
+  Cocoa                            = { inherit AppKit CoreData; };
+  Collaboration                    = {};
+  ColorSync                        = {};
+  Combine                          = {};
+  Contacts                         = {};
+  ContactsUI                       = {};
+  CoreAudio                        = { inherit IOKit CoreAudioTypes; };
+  CoreAudioKit                     = { inherit AudioUnit; };
+  CoreAudioTypes                   = {};
+  CoreBluetooth                    = {};
+  CoreData                         = { inherit CloudKit; };
+  CoreDisplay                      = {};
+  CoreFoundation                   = { inherit libobjc; };
+  CoreGraphics                     = { inherit Accelerate IOKit IOSurface SystemConfiguration; };
+  CoreHaptics                      = {};
+  CoreImage                        = {};
+  CoreLocation                     = {};
+  CoreMIDI                         = {};
+  CoreMIDIServer                   = { inherit CoreMIDI; };
+  CoreML                           = {};
+  CoreMedia                        = { inherit ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo; };
+  CoreMediaIO                      = { inherit CoreMedia; };
+  CoreMotion                       = {};
+  CoreServices                     = { inherit CFNetwork CoreAudio CoreData CoreFoundation DiskArbitration NetFS OpenDirectory Security ServiceManagement; };
+  CoreSpotlight                    = {};
+  CoreTelephony                    = {};
+  CoreText                         = { inherit CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreGraphics IOSurface OpenGL; };
+  CoreWLAN                         = { inherit SecurityFoundation; };
+  CryptoKit                        = {};
+  CryptoTokenKit                   = {};
+  DVDPlayback                      = {};
+  DeveloperToolsSupport            = {};
+  DeviceCheck                      = {};
+  DirectoryService                 = {};
+  DiscRecording                    = { inherit CoreServices IOKit libobjc; };
+  DiscRecordingUI                  = {};
+  DiskArbitration                  = { inherit IOKit; };
+  DriverKit                        = {};
+  EventKit                         = {};
+  ExceptionHandling                = {};
+  ExecutionPolicy                  = {};
+  ExternalAccessory                = {};
+  FWAUserLib                       = {};
+  FileProvider                     = {};
+  FileProviderUI                   = {};
+  FinderSync                       = {};
+  ForceFeedback                    = { inherit IOKit; };
+  Foundation                       = { inherit ApplicationServices CoreFoundation Security SystemConfiguration libobjc; };
+  GLKit                            = {};
+  GLUT                             = { inherit OpenGL; };
+  GSS                              = {};
+  GameController                   = {};
+  GameKit                          = { inherit Cocoa Foundation GameCenterFoundation GameCenterUI GameCenterUICore GameController GameplayKit Metal MetalKit ModelIO ReplayKit SceneKit SpriteKit; };
+  GameplayKit                      = {};
+  HIDDriverKit                     = {};
+  Hypervisor                       = {};
+  ICADevices                       = { inherit Carbon IOBluetooth libobjc; };
+  IMServicePlugIn                  = {};
+  IOBluetooth                      = { inherit CoreBluetooth IOKit; };
+  IOBluetoothUI                    = { inherit IOBluetooth; };
+  IOKit                            = {};
+  IOSurface                        = { inherit IOKit xpc; };
+  IOUSBHost                        = {};
+  IdentityLookup                   = {};
+  ImageCaptureCore                 = {};
+  ImageIO                          = { inherit CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon; };
+  InstallerPlugins                 = {};
+  InstantMessage                   = {};
+  Intents                          = {};
+  JavaNativeFoundation             = {};
+  JavaRuntimeSupport               = {};
+  JavaScriptCore                   = { inherit libobjc; };
+  Kerberos                         = {};
+  Kernel                           = { inherit IOKit; };
+  KernelManagement                 = {};
+  LDAP                             = {};
+  LatentSemanticMapping            = { inherit Carbon; };
+  LinkPresentation                 = { inherit URLFormatting; };
+  LocalAuthentication              = {};
+  MLCompute                        = {};
+  MapKit                           = {};
+  MediaAccessibility               = { inherit CoreGraphics CoreText QuartzCore; };
+  MediaLibrary                     = {};
+  MediaPlayer                      = {};
+  MediaToolbox                     = { inherit AudioToolbox AudioUnit CoreMedia; };
+  Message                          = {};
+  Metal                            = {};
+  MetalKit                         = { inherit Metal ModelIO; };
+  MetalPerformanceShaders          = {};
+  MetalPerformanceShadersGraph     = {};
+  MetricKit                        = { inherit SignpostMetrics; };
+  ModelIO                          = {};
+  MultipeerConnectivity            = {};
+  NaturalLanguage                  = {};
+  NearbyInteraction                = {};
+  NetFS                            = {};
+  Network                          = { inherit libnetwork; };
+  NetworkExtension                 = { inherit Network; };
+  NetworkingDriverKit              = {};
+  NotificationCenter               = {};
+  OSAKit                           = { inherit Carbon; };
+  OSLog                            = {};
+  OpenAL                           = {};
+  OpenCL                           = { inherit IOSurface OpenGL; };
+  OpenDirectory                    = {};
+  OpenGL                           = {};
+  PCIDriverKit                     = {};
+  PCSC                             = { inherit CoreData; };
+  PDFKit                           = {};
+  ParavirtualizedGraphics          = {};
+  PassKit                          = { inherit PassKitCore; };
+  PencilKit                        = {};
+  Photos                           = {};
+  PhotosUI                         = {};
+  PreferencePanes                  = {};
+  PushKit                          = {};
+  Python                           = {};
+  QTKit                            = { inherit CoreMedia CoreMediaIO MediaToolbox VideoToolbox; };
+  Quartz                           = { inherit QTKit QuartzCore QuickLook PDFKit; };
+  QuartzCore                       = { inherit ApplicationServices CoreImage CoreVideo Metal OpenCL libobjc; };
+  QuickLook                        = { inherit ApplicationServices; };
+  QuickLookThumbnailing            = {};
+  RealityKit                       = {};
+  ReplayKit                        = {};
+  Ruby                             = {};
+  SafariServices                   = {};
+  SceneKit                         = {};
+  ScreenSaver                      = {};
+  ScreenTime                       = {};
+  ScriptingBridge                  = {};
+  Security                         = { inherit IOKit libDER; };
+  SecurityFoundation               = { inherit Security; };
+  SecurityInterface                = { inherit Security SecurityFoundation; };
+  SensorKit                        = {};
+  ServiceManagement                = { inherit Security; };
+  Social                           = {};
+  SoundAnalysis                    = {};
+  Speech                           = {};
+  SpriteKit                        = {};
+  StoreKit                         = {};
+  SwiftUI                          = {};
+  SyncServices                     = {};
+  System                           = {};
+  SystemConfiguration              = { inherit Security; };
+  SystemExtensions                 = {};
+  TWAIN                            = { inherit Carbon; };
+  Tcl                              = {};
+  Tk                               = {};
+  USBDriverKit                     = {};
+  UniformTypeIdentifiers           = {};
+  UserNotifications                = {};
+  UserNotificationsUI              = {};
+  VideoDecodeAcceleration          = { inherit CoreVideo; };
+  VideoSubscriberAccount           = {};
+  VideoToolbox                     = { inherit CoreMedia CoreVideo; };
+  Virtualization                   = {};
+  Vision                           = {};
+  WebKit                           = { inherit ApplicationServices Carbon JavaScriptCore OpenGL libobjc; };
+  WidgetKit                        = {};
+  iTunesLibrary                    = {};
+  vmnet                            = {};
+}

pkgs/os-specific/darwin/apple-sdk-11.0/libSystem.nix

@@ -0,0 +1,78 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libSystem";
+  version = MacOSX-SDK.version;
+
+  dontBuild = true;
+  dontUnpack = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+  includeDirs = [
+    "CommonCrypto" "_types" "architecture" "arpa" "atm" "bank" "bsd" "bsm"
+    "corecrypto" "corpses" "default_pager" "device" "dispatch" "hfs" "i386"
+    "iokit" "kern" "libkern" "mach" "mach-o" "mach_debug" "machine" "malloc"
+    "miscfs" "net" "netinet" "netinet6" "netkey" "nfs" "os" "osfmk" "pexpert"
+    "platform" "protocols" "pthread" "rpc" "rpcsvc" "secure" "security"
+    "servers" "sys" "uuid" "vfs" "voucher" "xlocale"
+  ] ++ [
+    "arm" "xpc" "arm64"
+  ];
+
+  csu = [
+    "bundle1.o" "crt0.o" "crt1.10.5.o" "crt1.10.6.o" "crt1.o" "dylib1.10.5.o"
+    "dylib1.o" "gcrt1.o" "lazydylib1.o"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+
+    for dir in $includeDirs; do
+      from=${MacOSX-SDK}/usr/include/$dir
+      if [ -e "$from" ]; then
+        cp -dr $from $out/include
+      else
+        echo "Header directory '$from' doesn't exist: skipping"
+      fi
+    done
+
+    cp -d \
+      ${MacOSX-SDK}/usr/include/*.h \
+      $out/include
+
+    rm $out/include/tk*.h $out/include/tcl*.h
+
+    cp -dr \
+      ${MacOSX-SDK}/usr/lib/libSystem.* \
+      ${MacOSX-SDK}/usr/lib/system \
+      $out/lib
+
+    # Extra libraries
+    for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.1 resolv; do
+      cp -d \
+        ${MacOSX-SDK}/usr/lib/lib$name.tbd \
+        ${MacOSX-SDK}/usr/lib/lib$name.*.tbd \
+        $out/lib
+    done
+
+    for f in $csu; do
+      from=${MacOSX-SDK}/usr/lib/$f
+      if [ -e "$from" ]; then
+        cp -d $from $out/lib
+      else
+        echo "Csu file '$from' doesn't exist: skipping"
+      fi
+    done
+
+    chmod u+w -R $out/lib
+    find $out -name '*.tbd' -type f | while read tbd; do
+      rewrite-tbd \
+        -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
+        -p /usr/lib/system/:$out/lib/system/ \
+        -r ${builtins.storeDir} \
+        "$tbd"
+    done
+  '';
+}
+

pkgs/os-specific/darwin/apple-sdk-11.0/libcharset.nix

@@ -0,0 +1,16 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libcharset";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+    cp ${MacOSX-SDK}/usr/lib/libcharset* $out/lib
+  '';
+}

pkgs/os-specific/darwin/apple-sdk-11.0/libnetwork.nix

@@ -0,0 +1,20 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+let self = stdenvNoCC.mkDerivation {
+  pname = "libnetwork";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${MacOSX-SDK}/usr/lib/libnetwork* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libnetwork.dylib" = "${self}/lib/libnetwork.dylib";
+    };
+  };
+}; in self

pkgs/os-specific/darwin/apple-sdk-11.0/libobjc.nix

@@ -0,0 +1,21 @@
+{ stdenvNoCC, MacOSX-SDK, libcharset }:
+
+let self = stdenvNoCC.mkDerivation {
+  pname = "libobjc";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/{include,lib}
+    cp -r ${MacOSX-SDK}/usr/include/objc $out/include
+    cp ${MacOSX-SDK}/usr/lib/libobjc* $out/lib
+  '';
+
+  passthru = {
+    tbdRewrites = {
+      const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+    };
+  };
+}; in self

pkgs/os-specific/darwin/apple-sdk-11.0/libunwind.nix

@@ -0,0 +1,24 @@
+{ stdenvNoCC, buildPackages, MacOSX-SDK }:
+
+stdenvNoCC.mkDerivation {
+  pname = "libunwind";
+  version = MacOSX-SDK.version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/include/mach-o
+
+    cp \
+      ${MacOSX-SDK}/usr/include/libunwind.h \
+      ${MacOSX-SDK}/usr/include/unwind.h \
+      $out/include
+
+    cp \
+      ${MacOSX-SDK}/usr/include/mach-o/compact_unwind_encoding.h \
+      $out/include/mach-o
+  '';
+}

pkgs/os-specific/darwin/apple-sdk-11.0/private-frameworks.nix

@@ -0,0 +1,17 @@
+{ frameworks }: with frameworks;
+# generated by hand to avoid exposing all private frameworks
+# frameworks here are only the necessary ones used by public frameworks.
+{
+  AVFCapture = {};
+  AVFCore = {};
+  AddressBookCore = { inherit ContactsPersistence; };
+  AudioToolboxCore = {};
+  ContactsPersistence = {};
+  UIFoundation = {};
+  GameCenterFoundation = {};
+  GameCenterUI = {};
+  GameCenterUICore = {};
+  URLFormatting = {};
+  SignpostMetrics = {};
+  PassKitCore = {};
+}

pkgs/os-specific/darwin/apple-source-releases/ICU/default.nix

@@ -1,8 +1,20 @@
-{ appleDerivation, python3 }:
+{ appleDerivation, lib, stdenv, buildPackages, python3 }:
+
+let
+  formatVersionNumeric = version:
+    let
+      versionParts = lib.versions.splitVersion version;
+      major = lib.toInt (lib.elemAt versionParts 0);
+      minor = lib.toInt (lib.elemAt versionParts 1);
+      patch = if lib.length versionParts > 2 then lib.toInt (lib.elemAt versionParts 2) else 0;
+    in toString (major * 10000 + minor * 100 + patch);
+in
 
 appleDerivation {
   nativeBuildInputs = [ python3 ];
 
+  depsBuildBuild = lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [ buildPackages.stdenv.cc ];
+
   postPatch = ''
     substituteInPlace makefile \
       --replace "/usr/bin/" "" \
@@ -26,6 +38,13 @@ appleDerivation {
       --replace "&TestMailFilterCSS" "NULL"
 
     patchShebangs icuSources
+  '' + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+
+    # This looks like a bug in the makefile. It defines ENV_BUILDHOST to
+    # propagate the correct value of CC, CXX, etc, but has the following double
+    # expansion that results in the empty string.
+    substituteInPlace makefile \
+      --replace '$($(ENV_BUILDHOST))' '$(ENV_BUILDHOST)'
   '';
 
   # APPLE is using makefile to save its default configuration and call ./configure, so we hack makeFlags
@@ -40,10 +59,21 @@ appleDerivation {
 
     "DATA_INSTALL_DIR=/share/icu/"
     "DATA_LOOKUP_DIR=$(DSTROOT)$(DATA_INSTALL_DIR)"
-
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ # darwin* platform properties are only defined on darwin
     # hack to use our lower macos version
-    "MAC_OS_X_VERSION_MIN_REQUIRED=__MAC_OS_X_VERSION_MIN_REQUIRED"
+    "MAC_OS_X_VERSION_MIN_REQUIRED=${formatVersionNumeric stdenv.hostPlatform.darwinMinVersion}"
-    "OSX_HOST_VERSION_MIN_STRING=$(MACOSX_DEPLOYMENT_TARGET)"
+    "ICU_TARGET_VERSION=-m${stdenv.hostPlatform.darwinPlatform}-version-min=${stdenv.hostPlatform.darwinMinVersion}"
+  ]
+  ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "CROSS_BUILD=YES"
+    "BUILD_TYPE="
+    "RC_ARCHS=${stdenv.hostPlatform.darwinArch}"
+    "HOSTCC=cc"
+    "HOSTCXX=c++"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "CXX=${stdenv.cc.targetPrefix}c++"
+    "HOSTISYSROOT="
+    "OSX_HOST_VERSION_MIN_STRING=${stdenv.buildPlatform.darwinMinVersion}"
   ];
 
   doCheck = true;

pkgs/os-specific/darwin/apple-source-releases/adv_cmds/boot.nix

@@ -1,4 +1,4 @@
-{ lib, appleDerivation, fetchzip, bsdmake, perl, flex, bison
+{ lib, stdenv, buildPackages, appleDerivation, fetchzip, bsdmake, perl, flex, bison
 }:
 
 # this derivation sucks
@@ -16,6 +16,7 @@ let recentAdvCmds = fetchzip {
 };
 
 in appleDerivation {
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ bsdmake perl bison flex ];
   buildInputs = [ flex ];
 
@@ -61,7 +62,7 @@ in appleDerivation {
 
     bsdmake -C usr-share-locale.tproj
 
-    clang ${recentAdvCmds}/ps/*.c -o ps
+    ${stdenv.cc.targetPrefix}clang ${recentAdvCmds}/ps/*.c -o ps
   '';
 
   installPhase = ''

pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix

@@ -1,7 +1,7 @@
-{ lib, appleDerivation, xcbuildHook, llvmPackages }:
+{ lib, appleDerivation, xcbuildHook, llvmPackages, makeWrapper }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [ xcbuildHook makeWrapper ];
 
   patches = [
     # The following copied from
@@ -11,8 +11,9 @@ appleDerivation {
   ];
 
   postPatch = ''
+    makeWrapper ${llvmPackages.clang}/bin/clang $out/bin/clang-cpp --add-flags "--driver-mode=cpp"
     substituteInPlace rpcgen/rpc_main.c \
-      --replace "/usr/bin/cpp" "${llvmPackages.clang-unwrapped}/bin/clang-cpp"
+      --replace "/usr/bin/cpp" "$out/bin/clang-cpp"
   '';
 
   # temporary install phase until xcodebuild has "install" support

pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix

@@ -1,8 +1,8 @@
-{ lib, appleDerivation, xcbuildHook, zlib, bzip2, xz, ncurses, libutil }:
+{ lib, appleDerivation, xcbuildHook, zlib, bzip2, xz, ncurses, libutil, Libinfo }:
 
 appleDerivation {
   nativeBuildInputs = [ xcbuildHook ];
-  buildInputs = [ zlib bzip2 xz ncurses libutil ];
+  buildInputs = [ zlib bzip2 xz ncurses libutil Libinfo ];
 
   # some commands not working:
   # mtree: _simple.h not found

pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix

@@ -1,7 +1,7 @@
-{ lib, appleDerivation, xcbuildHook }:
+{ lib, appleDerivation, xcbuildHook, launchd }:
 
 appleDerivation {
-  nativeBuildInputs = [ xcbuildHook ];
+  nativeBuildInputs = [ xcbuildHook launchd ];
 
   patchPhase = ''
     # NOTE: these hashes must be recalculated for each version change

pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix

@@ -1,5 +1,5 @@
 { stdenv, appleDerivation, lib
-, Librpcsvc, apple_sdk, pam, CF, openbsm }:
+, libutil, Librpcsvc, apple_sdk, pam, CF, openbsm }:
 
 appleDerivation {
   # xcbuild fails with:
@@ -7,7 +7,7 @@ appleDerivation {
   # see issue facebook/xcbuild#188
   # buildInputs = [ xcbuild ];
 
-  buildInputs = [ Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
+  buildInputs = [ libutil Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
                   apple_sdk.frameworks.IOKit openbsm ];
   # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
   #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
@@ -35,6 +35,11 @@ appleDerivation {
       --replace bsm/audit_session.h bsm/audit.h
     substituteInPlace login.tproj/login_audit.c \
       --replace bsm/audit_session.h bsm/audit.h
+  '' + lib.optionalString stdenv.isAarch64 ''
+    substituteInPlace sysctl.tproj/sysctl.c \
+      --replace "GPROF_STATE" "0"
+    substituteInPlace login.tproj/login.c \
+      --replace "defined(__arm__)" "defined(__arm__) || defined(__arm64__)"
   '';
 
   buildPhase = ''

pkgs/os-specific/darwin/binutils/default.nix

@@ -9,6 +9,7 @@ let
   cmds = [
     "ar" "ranlib" "as" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
+    "codesign_allocate"
   ];
 in
 

pkgs/os-specific/darwin/cctools/port.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, autoreconfHook
 , installShellFiles
-, libcxxabi, libuuid
+, libuuid
 , libobjc ? null, maloader ? null
 , enableTapiSupport ? true, libtapi
 }:
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ];
   buildInputs = [ libuuid ]
-    ++ lib.optionals stdenv.isDarwin [ libcxxabi libobjc ]
+    ++ lib.optionals stdenv.isDarwin [ libobjc ]
     ++ lib.optional enableTapiSupport libtapi;
 
   patches = [ ./ld-ignore-rpath-link.patch ./ld-rpath-nonfinal.patch ];

pkgs/os-specific/darwin/libtapi/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, cmake, python3, ncurses }:
+{ lib, stdenv, fetchFromGitHub, pkgsBuildBuild, cmake, python3, ncurses }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "libtapi";
   version = "1100.0.11"; # determined by looking at VERSION.txt
 
@@ -13,13 +13,43 @@ stdenv.mkDerivation rec {
 
   sourceRoot = "source/src/llvm";
 
+  # Backported from newer llvm, fixes configure error when cross compiling.
+  # Also means we don't have to manually fix the result with install_name_tool.
+  patches = [
+    ./disable-rpath.patch
+  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    # TODO: make unconditional and rebuild the world
+    # TODO: send upstream
+    ./native-clang-tblgen.patch
+  ];
+
   nativeBuildInputs = [ cmake python3 ];
 
   # ncurses is required here to avoid a reference to bootstrap-tools, which is
   # not allowed for the stdenv.
   buildInputs = [ ncurses ];
 
-  cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ];
+  cmakeFlags = [ "-DLLVM_INCLUDE_TESTS=OFF" ]
+    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) [
+      "-DCMAKE_CROSSCOMPILING=True"
+      # This package could probably have a llvm_6 llvm-tblgen and clang-tblgen
+      # provided to reduce some building. This package seems intended to
+      # include all of its dependencies, including enough of LLVM to build the
+      # required tablegens.
+      (
+        let
+          nativeCC = pkgsBuildBuild.stdenv.cc;
+          nativeBintools = nativeCC.bintools.bintools;
+          nativeToolchainFlags = [
+            "-DCMAKE_C_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}cc"
+            "-DCMAKE_CXX_COMPILER=${nativeCC}/bin/${nativeCC.targetPrefix}c++"
+            "-DCMAKE_AR=${nativeBintools}/bin/${nativeBintools.targetPrefix}ar"
+            "-DCMAKE_STRIP=${nativeBintools}/bin/${nativeBintools.targetPrefix}strip"
+            "-DCMAKE_RANLIB=${nativeBintools}/bin/${nativeBintools.targetPrefix}ranlib"
+          ];
+        in "-DCROSS_TOOLCHAIN_FLAGS_NATIVE:list=${lib.concatStringsSep ";" nativeToolchainFlags}"
+      )
+    ];
 
   # fixes: fatal error: 'clang/Basic/Diagnostic.h' file not found
   # adapted from upstream
@@ -35,10 +65,6 @@ stdenv.mkDerivation rec {
 
   installTargets = [ "install-libtapi" "install-tapi-headers" "install-tapi" ];
 
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -id $out/lib/libtapi.dylib $out/lib/libtapi.dylib
-  '';
-
   meta = with lib; {
     description = "Replaces the Mach-O Dynamic Library Stub files in Apple's SDKs to reduce the size";
     homepage = "https://github.com/tpoechtrager/apple-libtapi";

pkgs/os-specific/darwin/libtapi/disable-rpath.patch

@@ -0,0 +1,14 @@
+diff --git a/src/llvm/cmake/modules/AddLLVM.cmake b/src/llvm/cmake/modules/AddLLVM.cmake
+index a53016eb0..b65e608a4 100644
+--- a/cmake/modules/AddLLVM.cmake
++++ b/cmake/modules/AddLLVM.cmake
+@@ -1683,8 +1683,7 @@ function(llvm_setup_rpath name)
+   endif()
+ 
+   if (APPLE)
+-    set(_install_name_dir INSTALL_NAME_DIR "@rpath")
+-    set(_install_rpath "@loader_path/../lib" ${extra_libdir})
++    set(_install_name_dir)
+   elseif(UNIX)
+     set(_install_rpath "\$ORIGIN/../lib${LLVM_LIBDIR_SUFFIX}" ${extra_libdir})
+     if(${CMAKE_SYSTEM_NAME} MATCHES "(FreeBSD|DragonFly)")

pkgs/os-specific/darwin/libtapi/native-clang-tblgen.patch

@@ -0,0 +1,21 @@
+diffprojects/libtapi/CMakeLists.txt b/src/llvm/projects/libtapi/CMakeLists.txt
+index 8ee6d8138..8277be147 100644
+--- a/projects/libtapi/CMakeLists.txt
++++ b/projects/libtapi/CMakeLists.txt
+@@ -193,7 +193,15 @@ if (NOT DEFINED CLANG_VERSION)
+   set(CLANG_VERSION "${LLVM_VERSION_MAJOR}.${LLVM_VERSION_MINOR}.${LLVM_VERSION_PATCH}")
+ endif ()
+ if (NOT DEFINED CLANG_TABLEGEN_EXE)
+-  set(CLANG_TABLEGEN_EXE "${LLVM_TOOLS_BINARY_DIR}/clang-tblgen")
++  if(LLVM_USE_HOST_TOOLS)
++    if (NOT CMAKE_CONFIGURATION_TYPES)
++      set(CLANG_TABLEGEN_EXE "${LLVM_NATIVE_BUILD}/bin/clang-tblgen")
++    else()
++      set(CLANG_TABLEGEN_EXE "${LLVM_NATIVE_BUILD}/Release/bin/clang-tblgen")
++    endif()
++  else()
++    set(CLANG_TABLEGEN_EXE "${LLVM_TOOLS_BINARY_DIR}/clang-tblgen")
++  endif ()
+ endif ()
+ 
+ # Include must go first.

pkgs/os-specific/darwin/print-reexports/default.nix

@@ -7,11 +7,11 @@ stdenv.mkDerivation {
   buildInputs = [ libyaml ];
 
   buildPhase = ''
-    $CC -lyaml -o $name main.c
+    $CC -lyaml -o print-reexports main.c
   '';
 
   installPhase = ''
     mkdir -p $out/bin
-    mv $name $out/bin
+    mv print-reexports $out/bin
   '';
 }

pkgs/os-specific/darwin/print-reexports/main.c

@@ -21,6 +21,10 @@
 #include <sys/errno.h>
 #include <yaml.h>
 
+#define LOG(str, ...) fprintf(stderr, "%s", str)
+
+#define LOGF(...) fprintf(stderr, __VA_ARGS__)
+
 static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *mapping, const char *name) {
   if (!mapping) {
     fprintf(stderr, "get_mapping_entry: mapping is null\n");
@@ -35,12 +39,12 @@ static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *ma
     yaml_node_t *key = yaml_document_get_node(document, pair->key);
 
     if (!key) {
-      fprintf(stderr, "get_mapping_entry: key (%i) is null\n", pair->key);
+      LOGF("key (%d) is null\n", pair->key);
       return NULL;
     }
 
     if (key->type != YAML_SCALAR_NODE) {
-      fprintf(stderr, "get_mapping_entry: key is not a scalar\n");
+      LOG("get_mapping_entry: key is not a scalar\n");
       return NULL;
     }
 
@@ -54,18 +58,17 @@ static yaml_node_t *get_mapping_entry(yaml_document_t *document, yaml_node_t *ma
   return NULL;
 }
 
-static int emit_reexports(yaml_document_t *document) {
+static int emit_reexports_v2(yaml_document_t *document) {
   yaml_node_t *root = yaml_document_get_root_node(document);
 
   yaml_node_t *exports = get_mapping_entry(document, root, "exports");
 
   if (!exports) {
-    fprintf(stderr, "emit_reexports: no exports found\n");
+    return 1;
-    return 0;
   }
 
   if (exports->type != YAML_SEQUENCE_NODE) {
-    fprintf(stderr, "emit_reexports, value is not a sequence\n");
+    LOG("value is not a sequence\n");
     return 0;
   }
 
@@ -82,6 +85,11 @@ static int emit_reexports(yaml_document_t *document) {
       continue;
     }
 
+    if (reexports->type != YAML_SEQUENCE_NODE) {
+      LOG("re-exports is not a sequence\n");
+      return 0;
+    }
+
     for (
         yaml_node_item_t *reexport = reexports->data.sequence.items.start;
         reexport < reexports->data.sequence.items.top;
@@ -90,7 +98,58 @@ static int emit_reexports(yaml_document_t *document) {
       yaml_node_t *val = yaml_document_get_node(document, *reexport);
 
       if (val->type != YAML_SCALAR_NODE) {
-        fprintf(stderr, "item is not a scalar\n");
+        LOG("item is not a scalar\n");
+        return 0;
+      }
+
+      fwrite(val->data.scalar.value, val->data.scalar.length, 1, stdout);
+      putchar('\n');
+    }
+  }
+
+  return 1;
+}
+
+static int emit_reexports_v4(yaml_document_t *document) {
+  yaml_node_t *root = yaml_document_get_root_node(document);
+  yaml_node_t *reexports = get_mapping_entry(document, root, "reexported-libraries");
+
+  if (!reexports) {
+    return 1;
+  }
+
+  if (reexports->type != YAML_SEQUENCE_NODE) {
+    LOG("value is not a sequence\n");
+    return 0;
+  }
+
+  for (
+      yaml_node_item_t *entry = reexports->data.sequence.items.start;
+      entry < reexports->data.sequence.items.top;
+      ++entry
+  ) {
+    yaml_node_t *entry_node = yaml_document_get_node(document, *entry);
+
+    yaml_node_t *libs = get_mapping_entry(document, entry_node, "libraries");
+
+    if (!libs) {
+      continue;
+    }
+
+    if (libs->type != YAML_SEQUENCE_NODE) {
+      LOG("libraries is not a sequence\n");
+      return 0;
+    }
+
+    for (
+        yaml_node_item_t *lib = libs->data.sequence.items.start;
+        lib < libs->data.sequence.items.top;
+        ++lib
+    ) {
+      yaml_node_t *val = yaml_document_get_node(document, *lib);
+
+      if (val->type != YAML_SCALAR_NODE) {
+        LOG("item is not a scalar\n");
         return 0;
       }
 
@@ -135,7 +194,13 @@ int main(int argc, char **argv) {
     goto err_yaml;
   }
 
-  emit_reexports(&yaml_document);
+  // Try both, only fail if one reports an error.  A lack of re-exports is not
+  // considered an error.
+  int ok = 1;
+  ok = ok && emit_reexports_v2(&yaml_document);
+  ok = ok && emit_reexports_v4(&yaml_document);
+
+  result = !ok;
 
 err_yaml:
   yaml_parser_delete(&yaml_parser);

pkgs/os-specific/darwin/print-reexports/setup-hook.sh

@@ -0,0 +1,19 @@
+fixupOutputHooks+=('checkTbdReexports')
+
+checkTbdReexports() {
+  local dir="$1"
+
+  while IFS= read -r -d $'\0' tbd; do
+    echo "checkTbdRexports: checking re-exports in $tbd"
+    while read -r target; do
+      local expected="${target%.dylib}.tbd"
+      if ! [ -e "$expected" ]; then
+        echo -e "Re-export missing:\n\t'$target'\n\t(expected '$expected')"
+        echo -e "While processing\n\t'$tbd'"
+        exit 1
+      else
+        echo "Re-exported target '$target' ok"
+      fi
+    done < <(print-reexports "$tbd")
+  done < <(find $prefix -type f -name '*.tbd' -print0)
+}

pkgs/os-specific/darwin/rewrite-tbd/default.nix

@@ -0,0 +1,16 @@
+{ stdenv, fetchFromGitHub, cmake, pkg-config, libyaml }:
+
+stdenv.mkDerivation {
+  pname = "rewrite-tbd";
+  version = "20201114";
+
+  src = fetchFromGitHub {
+    owner = "thefloweringash";
+    repo = "rewrite-tbd";
+    rev = "988f29c6ccbca9b883966225263d8d78676da6a3";
+    sha256 = "08sk91zwj6n9x2ymwid2k7y0rwv5b7p6h1b25ipx1dv0i43p6v1a";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ libyaml ];
+}

pkgs/os-specific/darwin/signing-utils/auto-sign-hook.sh

@@ -0,0 +1,20 @@
+fixupOutputHooks+=('signDarwinBinariesIn $prefix')
+
+# Uses signingUtils, see definition of autoSignDarwinBinariesHook in
+# darwin-packages.nix
+
+signDarwinBinariesIn() {
+  local dir="$1"
+
+  if [ ! -d "$dir" ]; then
+    return 0
+  fi
+
+  if [ "${darwinDontCodeSign:-}" ]; then
+    return 0
+  fi
+
+  while IFS= read -r -d $'\0' f; do
+    signIfRequired "$f"
+  done < <(find "$dir" -type f -print0)
+}

pkgs/os-specific/darwin/signing-utils/default.nix

@@ -0,0 +1,24 @@
+{ stdenvNoCC
+, sigtool
+, cctools
+}:
+
+let
+  stdenv = stdenvNoCC;
+in
+
+stdenv.mkDerivation {
+  name = "signing-utils";
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    substituteAll ${./utils.sh} $out
+  '';
+
+  # Substituted variables
+  inherit sigtool;
+  codesignAllocate = "${cctools}/bin/${cctools.targetPrefix}codesign_allocate";
+}

pkgs/os-specific/darwin/signing-utils/utils.sh

@@ -0,0 +1,43 @@
+# Work around for some odd behaviour where we can't codesign a file
+# in-place if it has been called before. This happens for example if
+# you try to fix-up a binary using strip/install_name_tool, after it
+# had been used previous.  The solution is to copy the binary (with
+# the corrupted signature from strip/install_name_tool) to some
+# location, sign it there and move it back into place.
+#
+# This does not appear to happen with the codesign tool that ships
+# with recent macOS BigSur installs on M1 arm64 machines.  However it
+# had also been happening with the tools that shipped with the DTKs.
+sign() {
+    local tmpdir
+    tmpdir=$(mktemp -d)
+
+    # $1 is the file
+
+    cp "$1" "$tmpdir"
+    CODESIGN_ALLOCATE=@codesignAllocate@ \
+        @sigtool@/bin/codesign -f -s - "$tmpdir/$(basename "$1")"
+    mv "$tmpdir/$(basename "$1")" "$1"
+    rmdir "$tmpdir"
+}
+
+checkRequiresSignature() {
+    local file=$1
+    local rc=0
+
+    @sigtool@/bin/sigtool --file "$file" check-requires-signature || rc=$?
+
+    if [ "$rc" -eq 0 ] || [ "$rc" -eq 1 ]; then
+        return "$rc"
+    fi
+
+    echo "Unexpected exit status from sigtool: $rc"
+    exit 1
+}
+
+signIfRequired() {
+    local file=$1
+    if checkRequiresSignature "$file"; then
+        sign "$file"
+    fi
+}

pkgs/os-specific/darwin/sigtool/default.nix

@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, makeWrapper, openssl }:
+
+stdenv.mkDerivation {
+  name = "sigtool";
+
+  src = fetchFromGitHub {
+    owner = "thefloweringash";
+    repo = "sigtool";
+    rev = "4a3719b42dc91c3f513df94048851cc98e7c7fcf";
+    sha256 = "04ra1cx7k1sdbkj5yrvl0s3l333vpir8rnm8k1dh2zy1w0a6hpqa";
+  };
+
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+  buildInputs = [ openssl ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  # Upstream (me) asserts the driver script is optional.
+  postInstall = ''
+    substitute $NIX_BUILD_TOP/$sourceRoot/codesign.sh $out/bin/codesign \
+      --replace sigtool "$out/bin/sigtool"
+    chmod a+x $out/bin/codesign
+  '';
+}

pkgs/os-specific/darwin/xcode/sdk-pkgs.nix

@@ -41,6 +41,7 @@ rec {
       mv cc-cflags.tmp $out/nix-support/cc-cflags
       echo "-target ${targetPlatform.config}" >> $out/nix-support/cc-cflags
       echo "-isystem ${sdk}/usr/include${lib.optionalString (lib.versionAtLeast "10" sdk.version) " -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++"}" >> $out/nix-support/cc-cflags
+      ${lib.optionalString (lib.versionAtLeast sdk.version "14") "echo -isystem ${xcode}/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include/c++/v1 >> $out/nix-support/cc-cflags"}
     '';
   }) // {
     inherit sdk;

pkgs/stdenv/cross/default.nix

@@ -48,7 +48,9 @@ in lib.init bootStages ++ [
       # Prior overrides are surely not valid as packages built with this run on
       # a different platform, and so are disabled.
       overrides = _: _: {};
-      extraBuildInputs = [ ]; # Old ones run on wrong platform
+      extraBuildInputs = [ ] # Old ones run on wrong platform
+         ++ lib.optionals hostPlatform.isDarwin [ buildPackages.targetPackages.darwin.apple_sdk.frameworks.CoreFoundation ]
+         ;
       allowedRequisites = null;
 
       hasCC = !targetPlatform.isGhcjs;

pkgs/stdenv/darwin/default.nix

@@ -1,7 +1,22 @@
 { lib
 , localSystem, crossSystem, config, overlays, crossOverlays ? []
 # Allow passing in bootstrap files directly so we can test the stdenv bootstrap process when changing the bootstrap tools
-, bootstrapFiles ? let
+, bootstrapFiles ?
+  if localSystem.isAarch64 then
+    let
+      fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
+        url = null; # to be built by hydra and injected here
+        inherit (localSystem) system;
+        inherit sha256 executable;
+      }; in {
+        sh      = fetch { file = "sh";    sha256 = "0000000000000000000000000000000000000000000000000000"; };
+        bzip2   = fetch { file = "bzip2"; sha256 = "0000000000000000000000000000000000000000000000000000"; };
+        mkdir   = fetch { file = "mkdir"; sha256 = "0000000000000000000000000000000000000000000000000000"; };
+        cpio    = fetch { file = "cpio";  sha256 = "0000000000000000000000000000000000000000000000000000"; };
+        tarball = fetch { file = "bootstrap-tools.cpio.bz2"; sha256 = "0000000000000000000000000000000000000000000000000000"; executable = false; };
+      }
+  else
+    let
       fetch = { file, sha256, executable ? true }: import <nix/fetchurl.nix> {
         url = "http://tarballs.nixos.org/stdenv-darwin/x86_64/5ab5783e4f46c373c6de84deac9ad59b608bb2e6/${file}";
         inherit (localSystem) system;
@@ -20,13 +35,22 @@ assert crossSystem == localSystem;
 let
   inherit (localSystem) system;
 
-  bootstrapClangVersion = "7.1.0";
+  # Bootstrap version needs to be known to reference headers included in the bootstrap tools
+  bootstrapLlvmVersion = if localSystem.isAarch64 then "11.1.0" else "7.1.0";
+
+  useAppleSDKLibs = localSystem.isAarch64;
+  haveKRB5 = localSystem.isx86_64;
+
+  # final toolchain is injected into llvmPackages_${finalLlvmVersion}
+  finalLlvmVersion = if localSystem.isAarch64 then "11" else "7";
+  finalLlvmPackages = "llvmPackages_${finalLlvmVersion}";
 
   commonImpureHostDeps = [
     "/bin/sh"
     "/usr/lib/libSystem.B.dylib"
     "/usr/lib/system/libunc.dylib" # This dependency is "hidden", so our scanning code doesn't pick it up
   ];
+
 in rec {
   commonPreHook = ''
     export NIX_ENFORCE_NO_NATIVE=''${NIX_ENFORCE_NO_NATIVE-1}
@@ -45,7 +69,7 @@ in rec {
 
     name    = "bootstrap-tools";
     builder = bootstrapFiles.sh; # Not a filename! Attribute 'sh' on bootstrapFiles
-    args    = [ ./unpack-bootstrap-tools.sh ];
+    args    = if localSystem.isAarch64 then [ ./unpack-bootstrap-tools-aarch64.sh ] else [ ./unpack-bootstrap-tools.sh ];
 
     inherit (bootstrapFiles) mkdir bzip2 cpio tarball;
 
@@ -70,11 +94,14 @@ in rec {
         inherit (last) stdenv;
       };
 
+      doSign = localSystem.isAarch64 && last != null;
+      doUpdateAutoTools = localSystem.isAarch64 && last != null;
+
       mkExtraBuildCommands = cc: ''
         rsrc="$out/resource-root"
         mkdir "$rsrc"
         ln -s "${cc.lib or cc}/lib/clang/${cc.version}/include" "$rsrc"
-        ln -s "${last.pkgs.llvmPackages_7.compiler-rt.out}/lib" "$rsrc/lib"
+        ln -s "${last.pkgs."${finalLlvmPackages}".compiler-rt.out}/lib" "$rsrc/lib"
         echo "-resource-dir=$rsrc" >> $out/nix-support/cc-cflags
       '';
 
@@ -90,13 +117,13 @@ in rec {
           bintools     = last.pkgs.darwin.binutils;
           libc         = last.pkgs.darwin.Libsystem;
           isClang      = true;
-          cc           = last.pkgs.llvmPackages_7.clang-unwrapped;
+          cc           = last.pkgs."${finalLlvmPackages}".clang-unwrapped;
         }; in args // (overrides args));
 
       cc = if last == null then "/dev/null" else mkCC ({ cc, ... }: {
         extraPackages = [
-          last.pkgs.llvmPackages_7.libcxxabi
+          last.pkgs."${finalLlvmPackages}".libcxxabi
-          last.pkgs.llvmPackages_7.compiler-rt
+          last.pkgs."${finalLlvmPackages}".compiler-rt
         ];
         extraBuildCommands = mkExtraBuildCommands cc;
       });
@@ -104,11 +131,11 @@ in rec {
       ccNoLibcxx = if last == null then "/dev/null" else mkCC ({ cc, ... }: {
         libcxx = null;
         extraPackages = [
-          last.pkgs.llvmPackages_7.compiler-rt
+          last.pkgs."${finalLlvmPackages}".compiler-rt
         ];
         extraBuildCommands = ''
           echo "-rtlib=compiler-rt" >> $out/nix-support/cc-cflags
-          echo "-B${last.pkgs.llvmPackages_7.compiler-rt}/lib" >> $out/nix-support/cc-cflags
+          echo "-B${last.pkgs."${finalLlvmPackages}".compiler-rt}/lib" >> $out/nix-support/cc-cflags
           echo "-nostdlib++" >> $out/nix-support/cc-cflags
         '' + mkExtraBuildCommands cc;
       });
@@ -116,9 +143,20 @@ in rec {
       thisStdenv = import ../generic {
         name = "${name}-stdenv-darwin";
 
-        inherit config shell extraNativeBuildInputs extraBuildInputs;
+        inherit config shell extraBuildInputs;
+
+        extraNativeBuildInputs = extraNativeBuildInputs ++ lib.optionals doUpdateAutoTools [
+          last.pkgs.updateAutotoolsGnuConfigScriptsHook last.pkgs.gnu-config
+        ];
+
         allowedRequisites = if allowedRequisites == null then null else allowedRequisites ++ [
           cc.expand-response-params cc.bintools
+        ] ++ lib.optionals doUpdateAutoTools [
+          last.pkgs.updateAutotoolsGnuConfigScriptsHook last.pkgs.gnu-config
+        ] ++ lib.optionals doSign [
+          last.pkgs.darwin.postLinkSignHook
+          last.pkgs.darwin.sigtool
+          last.pkgs.darwin.signingUtils
         ];
 
         buildPlatform = localSystem;
@@ -176,7 +214,97 @@ in rec {
         '';
       };
 
+      pbzx = stdenv.mkDerivation {
+        name = "bootstrap-stage0-pbzx";
+        phases = [ "installPhase" ];
+        installPhase = ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapTools}/bin/pbzx $out/bin
+        '';
+      };
+
+      cpio = stdenv.mkDerivation {
+        name = "bootstrap-stage0-cpio";
+        phases = [ "installPhase" ];
+        installPhase = ''
+          mkdir -p $out/bin
+          ln -s ${bootstrapFiles.cpio} $out/bin/cpio
+        '';
+      };
+
       darwin = super.darwin.overrideScope (selfDarwin: superDarwin: {
+        darwin-stubs = superDarwin.darwin-stubs.override { inherit (self) stdenvNoCC fetchurl; };
+
+        dyld = {
+          name = "bootstrap-stage0-dyld";
+          buildCommand = ''
+            mkdir -p $out
+            ln -s ${bootstrapTools}/lib     $out/lib
+            ln -s ${bootstrapTools}/include $out/include
+          '';
+        };
+
+        sigtool = stdenv.mkDerivation {
+          name = "bootstrap-stage0-sigtool";
+          phases = [ "installPhase" ];
+          installPhase = ''
+            mkdir -p $out/bin
+            ln -s ${bootstrapTools}/bin/sigtool $out/bin
+
+            # Rewrite nuked references
+            sed -e "s|[^( ]*\bsigtool\b|$out/bin/sigtool|g" \
+              ${bootstrapTools}/bin/codesign > $out/bin/codesign
+            chmod a+x $out/bin/codesign
+          '';
+        };
+
+        print-reexports = stdenv.mkDerivation {
+          name = "bootstrap-stage0-print-reexports";
+          phases = [ "installPhase" ];
+          installPhase = ''
+            mkdir -p $out/bin
+            ln -s ${bootstrapTools}/bin/print-reexports $out/bin
+          '';
+        };
+
+        rewrite-tbd = stdenv.mkDerivation {
+          name = "bootstrap-stage0-rewrite-tbd";
+          phases = [ "installPhase" ];
+          installPhase = ''
+            mkdir -p $out/bin
+            ln -s ${bootstrapTools}/bin/rewrite-tbd $out/bin
+          '';
+        };
+
+        binutils-unwrapped = { name = "bootstrap-stage0-binutils"; outPath = bootstrapTools; };
+
+        cctools = {
+          name = "bootstrap-stage0-cctools";
+          outPath = bootstrapTools;
+          targetPrefix = "";
+        };
+
+        binutils = lib.makeOverridable (import ../../build-support/bintools-wrapper) {
+          shell = "${bootstrapTools}/bin/bash";
+          inherit lib;
+          inherit (self) stdenvNoCC;
+
+          nativeTools  = false;
+          nativeLibc   = false;
+          inherit (self) buildPackages coreutils gnugrep;
+          libc         = selfDarwin.Libsystem;
+          bintools     = selfDarwin.binutils-unwrapped;
+          inherit (selfDarwin) postLinkSignHook signingUtils;
+        };
+      } // lib.optionalAttrs (! useAppleSDKLibs) {
+        CF = stdenv.mkDerivation {
+          name = "bootstrap-stage0-CF";
+          buildCommand = ''
+            mkdir -p $out/Library/Frameworks
+            ln -s ${bootstrapTools}/Library/Frameworks/CoreFoundation.framework $out/Library/Frameworks
+          '';
+        };
+
         Libsystem = stdenv.mkDerivation {
           name = "bootstrap-stage0-Libsystem";
           buildCommand = ''
@@ -200,35 +328,12 @@ in rec {
             ln -s ${bootstrapTools}/include-Libsystem $out/include
           '';
         };
-
-        darwin-stubs = superDarwin.darwin-stubs.override { inherit (self) stdenvNoCC fetchurl; };
-
-        dyld = {
-          name = "bootstrap-stage0-dyld";
-          buildCommand = ''
-            mkdir -p $out
-            ln -s ${bootstrapTools}/lib     $out/lib
-            ln -s ${bootstrapTools}/include $out/include
-          '';
-        };
-
-        binutils = lib.makeOverridable (import ../../build-support/bintools-wrapper) {
-          shell = "${bootstrapTools}/bin/bash";
-          inherit lib;
-          inherit (self) stdenvNoCC;
-
-          nativeTools  = false;
-          nativeLibc   = false;
-          inherit (self) buildPackages coreutils gnugrep;
-          libc         = selfDarwin.Libsystem;
-          bintools     = { name = "bootstrap-stage0-binutils"; outPath = bootstrapTools; };
-        };
       });
 
-      llvmPackages_7 = {
+      "${finalLlvmPackages}" = {
         clang-unwrapped = stdenv.mkDerivation {
           name = "bootstrap-stage0-clang";
-          version = bootstrapClangVersion;
+          version = bootstrapLlvmVersion;
           buildCommand = ''
             mkdir -p $out/lib
             ln -s ${bootstrapTools}/bin $out/bin
@@ -278,36 +383,46 @@ in rec {
     persistent = self: super: with prevStage; {
       cmake = super.cmakeMinimal;
 
+      inherit pbzx cpio;
+
       python3 = super.python3Minimal;
 
       ninja = super.ninja.override { buildDocs = false; };
 
-      llvmPackages_7 = super.llvmPackages_7 // (let
+      "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (let
-        tools = super.llvmPackages_7.tools.extend (_: _: {
+        tools = super."${finalLlvmPackages}".tools.extend (_: _: {
-          inherit (llvmPackages_7) clang-unwrapped;
+          inherit (pkgs."${finalLlvmPackages}") clang-unwrapped;
         });
-        libraries = super.llvmPackages_7.libraries.extend (_: _: {
+        libraries = super."${finalLlvmPackages}".libraries.extend (_: _: {
-          inherit (llvmPackages_7) compiler-rt libcxx libcxxabi;
+          inherit (pkgs."${finalLlvmPackages}") compiler-rt libcxx libcxxabi;
         });
       in { inherit tools libraries; } // tools // libraries);
 
       darwin = super.darwin.overrideScope (selfDarwin: _: {
+        inherit (darwin) rewrite-tbd binutils-unwrapped;
+
+        signingUtils = darwin.signingUtils.override {
+          inherit (selfDarwin) sigtool;
+        };
+
         binutils = darwin.binutils.override {
           coreutils = self.coreutils;
           libc = selfDarwin.Libsystem;
+          inherit (selfDarwin) postLinkSignHook signingUtils;
         };
       });
     };
   in with prevStage; stageFun 1 prevStage {
     extraPreHook = "export NIX_CFLAGS_COMPILE+=\" -F${bootstrapTools}/Library/Frameworks\"";
     extraNativeBuildInputs = [];
-    extraBuildInputs = [ ];
+    extraBuildInputs = [ pkgs.darwin.CF ];
-    libcxx = pkgs.libcxx;
+    libcxx = pkgs."${finalLlvmPackages}".libcxx;
 
     allowedRequisites =
       [ bootstrapTools ] ++
-      (with pkgs; [ coreutils gnugrep libcxx libcxxabi llvmPackages_7.clang-unwrapped llvmPackages_7.compiler-rt ]) ++
+      (with pkgs; [ coreutils gnugrep ]) ++
-      (with pkgs.darwin; [ darwin-stubs Libsystem ]);
+      (with pkgs."${finalLlvmPackages}"; [ libcxx libcxxabi compiler-rt clang-unwrapped ]) ++
+      (with pkgs.darwin; [ Libsystem CF ] ++ lib.optional useAppleSDKLibs objc4);
 
     overrides = persistent;
   };
@@ -321,26 +436,30 @@ in rec {
         findfreetype libssh curl cmake autoconf automake libtool ed cpio coreutils
         libssh2 nghttp2 libkrb5 ninja brotli;
 
-      llvmPackages_7 = super.llvmPackages_7 // (let
+      "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (let
-        tools = super.llvmPackages_7.tools.extend (_: _: {
+        tools = super."${finalLlvmPackages}".tools.extend (_: _: {
-          inherit (llvmPackages_7) clang-unwrapped;
+          inherit (pkgs."${finalLlvmPackages}") clang-unwrapped;
         });
-        libraries = super.llvmPackages_7.libraries.extend (_: libSuper: {
+        libraries = super."${finalLlvmPackages}".libraries.extend (_: libSuper: {
-          inherit (llvmPackages_7) compiler-rt;
+          inherit (pkgs."${finalLlvmPackages}") compiler-rt;
           libcxx = libSuper.libcxx.override {
             stdenv = overrideCC self.stdenv self.ccNoLibcxx;
           };
-          libcxxabi = libSuper.libcxxabi.override {
+          libcxxabi = libSuper.libcxxabi.override ({
             stdenv = overrideCC self.stdenv self.ccNoLibcxx;
+          } // lib.optionalAttrs (finalLlvmVersion == "7") {
+            # TODO: the bootstrapping of llvm packages isn't consistent.
+            # `standalone` may be redundant if darwin behaves like useLLVM (or
+            # has useLLVM = true).
             standalone = true;
-          };
+          });
         });
       in { inherit tools libraries; } // tools // libraries);
 
       darwin = super.darwin.overrideScope (_: _: {
         inherit (darwin)
           binutils dyld Libsystem xnu configd ICU libdispatch libclosure
-          launchd CF darwin-stubs;
+          launchd CF objc4 darwin-stubs sigtool postLinkSignHook signingUtils;
       });
     };
   in with prevStage; stageFun 2 prevStage {
@@ -350,16 +469,18 @@ in rec {
 
     extraNativeBuildInputs = [ pkgs.xz ];
     extraBuildInputs = [ pkgs.darwin.CF ];
-    libcxx = pkgs.libcxx;
+    libcxx = pkgs."${finalLlvmPackages}".libcxx;
 
     allowedRequisites =
       [ bootstrapTools ] ++
       (with pkgs; [
-        xz.bin xz.out libcxx libcxxabi llvmPackages_7.compiler-rt
+        xz.bin xz.out zlib libxml2.out curl.out openssl.out libssh2.out
-        llvmPackages_7.clang-unwrapped zlib libxml2.out curl.out brotli.lib openssl.out
+        nghttp2.lib coreutils gnugrep pcre.out gmp libiconv brotli.lib
-        libssh2.out nghttp2.lib libkrb5 coreutils gnugrep pcre.out gmp libiconv
+      ] ++ lib.optional haveKRB5 libkrb5) ++
+      (with pkgs."${finalLlvmPackages}"; [
+       libcxx libcxxabi compiler-rt clang-unwrapped
       ]) ++
-      (with pkgs.darwin; [ dyld Libsystem CF ICU locale ]);
+      (with pkgs.darwin; [ dyld Libsystem CF ICU locale ] ++ lib.optional useAppleSDKLibs objc4);
 
     overrides = persistent;
   };
@@ -376,16 +497,16 @@ in rec {
       # Avoid pulling in a full python and its extra dependencies for the llvm/clang builds.
       libxml2 = super.libxml2.override { pythonSupport = false; };
 
-      llvmPackages_7 = super.llvmPackages_7 // (let
+      "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (let
-        libraries = super.llvmPackages_7.libraries.extend (_: _: {
+        libraries = super."${finalLlvmPackages}".libraries.extend (_: _: {
-          inherit (llvmPackages_7) libcxx libcxxabi;
+          inherit (pkgs."${finalLlvmPackages}") libcxx libcxxabi;
         });
       in { inherit libraries; } // libraries);
 
       darwin = super.darwin.overrideScope (_: _: {
         inherit (darwin)
           dyld Libsystem xnu configd libdispatch libclosure launchd libiconv
-          locale darwin-stubs;
+          locale darwin-stubs sigtool;
       });
     };
   in with prevStage; stageFun 3 prevStage {
@@ -397,7 +518,7 @@ in rec {
     # patches our shebangs back to point at bootstrapTools. This makes sure bash comes first.
     extraNativeBuildInputs = with pkgs; [ xz ];
     extraBuildInputs = [ pkgs.darwin.CF pkgs.bash ];
-    libcxx = pkgs.libcxx;
+    libcxx = pkgs."${finalLlvmPackages}".libcxx;
 
     extraPreHook = ''
       export PATH=${pkgs.bash}/bin:$PATH
@@ -407,11 +528,13 @@ in rec {
     allowedRequisites =
       [ bootstrapTools ] ++
       (with pkgs; [
-        xz.bin xz.out bash libcxx libcxx.dev libcxxabi libcxxabi.dev llvmPackages_7.compiler-rt
+        xz.bin xz.out bash zlib libxml2.out curl.out openssl.out libssh2.out
-        llvmPackages_7.clang-unwrapped zlib libxml2.out curl.out brotli.lib openssl.out
+        nghttp2.lib coreutils gnugrep pcre.out gmp libiconv brotli.lib
-        libssh2.out nghttp2.lib libkrb5 coreutils gnugrep pcre.out gmp libiconv
+      ] ++ lib.optional haveKRB5 libkrb5) ++
+      (with pkgs."${finalLlvmPackages}"; [
+       libcxx libcxx.dev libcxxabi libcxxabi.dev compiler-rt clang-unwrapped
       ]) ++
-      (with pkgs.darwin; [ dyld ICU Libsystem locale ]);
+      (with pkgs.darwin; [ dyld ICU Libsystem locale ] ++ lib.optional useAppleSDKLibs objc4);
 
     overrides = persistent;
   };
@@ -432,20 +555,21 @@ in rec {
         ];
       });
 
-      llvmPackages_7 = super.llvmPackages_7 // (let
+      "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (let
-        tools = super.llvmPackages_7.tools.extend (llvmSelf: _: {
+        tools = super."${finalLlvmPackages}".tools.extend (llvmSelf: _: {
-          clang-unwrapped-all-outputs = llvmPackages_7.clang-unwrapped-all-outputs.override { llvm = llvmSelf.llvm; };
+          clang-unwrapped-all-outputs = pkgs."${finalLlvmPackages}".clang-unwrapped-all-outputs.override { llvm = llvmSelf.llvm; };
-          libllvm = llvmPackages_7.libllvm.override { inherit libxml2; };
+          libllvm = pkgs."${finalLlvmPackages}".libllvm.override { inherit libxml2; };
         });
-        libraries = super.llvmPackages_7.libraries.extend (llvmSelf: _: {
+        libraries = super."${finalLlvmPackages}".libraries.extend (llvmSelf: _: {
-          inherit (llvmPackages_7) libcxx libcxxabi compiler-rt;
+          inherit (pkgs."${finalLlvmPackages}") libcxx libcxxabi compiler-rt;
         });
       in { inherit tools libraries; } // tools // libraries);
 
       darwin = super.darwin.overrideScope (_: superDarwin: {
         inherit (darwin) dyld Libsystem libiconv locale darwin-stubs;
 
-        CF = superDarwin.CF.override {
+        # See useAppleSDKLibs in darwin-packages.nix
+        CF = if useAppleSDKLibs then super.darwin.CF else superDarwin.CF.override {
           inherit libxml2;
           python3 = prevStage.python3;
         };
@@ -455,7 +579,7 @@ in rec {
     shell = "${pkgs.bash}/bin/bash";
     extraNativeBuildInputs = with pkgs; [ xz ];
     extraBuildInputs = [ pkgs.darwin.CF pkgs.bash ];
-    libcxx = pkgs.libcxx;
+    libcxx = pkgs."${finalLlvmPackages}".libcxx;
 
     extraPreHook = ''
       export PATH_LOCALE=${pkgs.darwin.locale}/share/locale
@@ -464,29 +588,32 @@ in rec {
   };
 
   stdenvDarwin = prevStage: let
+    doSign = localSystem.isAarch64;
     pkgs = prevStage;
     persistent = self: super: with prevStage; {
       inherit
         gnumake gzip gnused bzip2 gawk ed xz patch bash
-        ncurses libffi zlib llvm gmp pcre gnugrep
+        ncurses libffi zlib gmp pcre gnugrep
-        coreutils findutils diffutils patchutils;
+        coreutils findutils diffutils patchutils pbzx;
-
-      llvmPackages_7 = super.llvmPackages_7 // (let
-        tools = super.llvmPackages_7.tools.extend (_: super: {
-          inherit (llvmPackages_7) llvm clang-unwrapped;
-        });
-        libraries = super.llvmPackages_7.libraries.extend (_: _: {
-          inherit (llvmPackages_7) compiler-rt libcxx libcxxabi;
-        });
-      in { inherit tools libraries; } // tools // libraries);
 
       darwin =  super.darwin.overrideScope (_: _: {
-        inherit (darwin) dyld ICU Libsystem libiconv;
+        inherit (darwin) dyld ICU Libsystem Csu libiconv rewrite-tbd;
       } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
         inherit (darwin) binutils binutils-unwrapped cctools;
       });
     } // lib.optionalAttrs (super.stdenv.targetPlatform == localSystem) {
+      inherit llvm;
+
       # Need to get rid of these when cross-compiling.
+      "${finalLlvmPackages}" = super."${finalLlvmPackages}" // (let
+        tools = super."${finalLlvmPackages}".tools.extend (_: super: {
+          inherit (pkgs."${finalLlvmPackages}") llvm clang-unwrapped;
+        });
+        libraries = super."${finalLlvmPackages}".libraries.extend (_: _: {
+          inherit (pkgs."${finalLlvmPackages}") compiler-rt libcxx libcxxabi;
+        });
+      in { inherit tools libraries; } // tools // libraries);
+
       inherit binutils binutils-unwrapped;
     };
   in import ../generic rec {
@@ -510,11 +637,12 @@ in rec {
     initialPath = import ../common-path.nix { inherit pkgs; };
     shell       = "${pkgs.bash}/bin/bash";
 
-    cc = pkgs.llvmPackages.libcxxClang.override {
+    cc = pkgs."${finalLlvmPackages}".libcxxClang;
-      cc = pkgs.llvmPackages.clang-unwrapped;
+
-    };
+    extraNativeBuildInputs = lib.optionals localSystem.isAarch64 [
+      pkgs.updateAutotoolsGnuConfigScriptsHook
+    ];
 
-    extraNativeBuildInputs = [];
     extraBuildInputs = [ pkgs.darwin.CF ];
 
     extraAttrs = {
@@ -524,19 +652,27 @@ in rec {
     };
 
     allowedRequisites = (with pkgs; [
-      xz.out xz.bin libcxx libcxx.dev libcxxabi libcxxabi.dev gmp.out gnumake findutils bzip2.out
+      xz.out xz.bin gmp.out gnumake findutils bzip2.out
-      bzip2.bin llvmPackages.llvm llvmPackages.llvm.lib llvmPackages.compiler-rt llvmPackages.compiler-rt.dev
+      bzip2.bin
       zlib.out zlib.dev libffi.out coreutils ed diffutils gnutar
       gzip ncurses.out ncurses.dev ncurses.man gnused bash gawk
-      gnugrep llvmPackages.clang-unwrapped
+      gnugrep patch pcre.out gettext
-      llvmPackages.libclang.dev llvmPackages.libclang.lib
-      patch pcre.out gettext
       binutils.bintools darwin.binutils darwin.binutils.bintools
-      curl.out brotli.lib openssl.out libssh2.out nghttp2.lib libkrb5
+      curl.out openssl.out libssh2.out nghttp2.lib brotli.lib
       cc.expand-response-params libxml2.out
-    ]) ++ (with pkgs.darwin; [
+    ] ++ lib.optional haveKRB5 libkrb5
+    ++ lib.optionals localSystem.isAarch64 [
+      pkgs.updateAutotoolsGnuConfigScriptsHook pkgs.gnu-config
+    ])
+    ++ (with pkgs."${finalLlvmPackages}"; [
+      libcxx libcxx.dev libcxxabi libcxxabi.dev
+      llvm llvm.lib compiler-rt compiler-rt.dev
+      clang-unwrapped libclang.dev libclang.lib
+    ])
+    ++ (with pkgs.darwin; [
       dyld Libsystem CF cctools ICU libiconv locale libtapi
-    ]);
+    ] ++ lib.optional useAppleSDKLibs objc4
+    ++ lib.optionals doSign [ postLinkSignHook sigtool signingUtils ]);
 
     overrides = lib.composeExtensions persistent (self: super: {
       darwin = super.darwin.overrideScope (_: superDarwin: {

pkgs/stdenv/darwin/make-bootstrap-tools.nix

@@ -1,9 +1,15 @@
-{ pkgspath ? ../../.., test-pkgspath ? pkgspath, system ? builtins.currentSystem }:
+{ pkgspath ? ../../.., test-pkgspath ? pkgspath, system ? builtins.currentSystem, crossSystem ? null }:
-
-with import pkgspath { inherit system; };
 
 let
-  llvmPackages = llvmPackages_7;
+  pkgs = import pkgspath ({ inherit system; } // (if (crossSystem != null) then { inherit crossSystem; } else {}));
+in
+
+with pkgs;
+
+let
+  llvmPackageSet = if stdenv.hostPlatform.isAarch64 then "llvmPackages_11" else "llvmPackages_7";
+  llvmPackages = pkgs."${llvmPackageSet}";
+  storePrefixLen = builtins.stringLength builtins.storeDir;
 in rec {
   coreutils_ = coreutils.override (args: {
     # We want coreutils without ACL support.
@@ -23,11 +29,13 @@ in rec {
   build = stdenv.mkDerivation {
     name = "stdenv-bootstrap-tools";
 
-    buildInputs = [nukeReferences cpio];
+    nativeBuildInputs = [ buildPackages.nukeReferences buildPackages.cpio ]
+      ++ lib.optionals targetPlatform.isAarch64 [ buildPackages.darwin.sigtool ];
 
     buildCommand = ''
-      mkdir -p $out/bin $out/lib $out/lib/system
+      mkdir -p $out/bin $out/lib $out/lib/system $out/lib/darwin
 
+      ${lib.optionalString stdenv.targetPlatform.isx86_64 ''
         # Copy libSystem's .o files for various low-level boot stuff.
         cp -d ${darwin.Libsystem}/lib/*.o $out/lib
 
@@ -40,6 +48,7 @@ in rec {
         cp -rL ${libiconv}/include/*       $out/include
         cp -rL ${gnugrep.pcre.dev}/include/*   $out/include
         mv $out/include $out/include-Libsystem
+      ''}
 
       # Copy coreutils, bash, etc.
       cp ${coreutils_}/bin/* $out/bin
@@ -76,39 +85,60 @@ in rec {
 
       # Copy what we need of clang
       cp -d ${llvmPackages.clang-unwrapped}/bin/clang* $out/bin
-
+      cp -rd ${llvmPackages.clang-unwrapped.lib}/lib/* $out/lib
-      cp -rL ${llvmPackages.clang-unwrapped.lib}/lib/clang $out/lib
 
       cp -d ${llvmPackages.libcxx}/lib/libc++*.dylib $out/lib
       cp -d ${llvmPackages.libcxxabi}/lib/libc++abi*.dylib $out/lib
+      cp -d ${llvmPackages.compiler-rt}/lib/darwin/libclang_rt* $out/lib/darwin
+      cp -d ${llvmPackages.compiler-rt}/lib/libclang_rt* $out/lib
       cp -d ${llvmPackages.llvm.lib}/lib/libLLVM.dylib $out/lib
       cp -d ${libffi}/lib/libffi*.dylib $out/lib
 
       mkdir $out/include
       cp -rd ${llvmPackages.libcxx.dev}/include/c++     $out/include
 
+      ${lib.optionalString targetPlatform.isAarch64 ''
+        # copy .tbd assembly utils
+        cp -d ${pkgs.darwin.rewrite-tbd}/bin/rewrite-tbd $out/bin
+        cp -d ${pkgs.libyaml}/lib/libyaml*.dylib $out/lib
+
+        # copy package extraction tools
+        cp -d ${pkgs.pbzx}/bin/pbzx $out/bin
+        cp -d ${pkgs.xar}/lib/libxar*.dylib $out/lib
+        cp -d ${pkgs.bzip2.out}/lib/libbz2*.dylib $out/lib
+
+        # copy sigtool
+        cp -d ${pkgs.darwin.sigtool}/bin/sigtool $out/bin
+        cp -d ${pkgs.darwin.sigtool}/bin/codesign $out/bin
+      ''}
+
       cp -d ${darwin.ICU}/lib/libicu*.dylib $out/lib
       cp -d ${zlib.out}/lib/libz.*       $out/lib
       cp -d ${gmpxx.out}/lib/libgmp*.*   $out/lib
       cp -d ${xz.out}/lib/liblzma*.*     $out/lib
 
       # Copy binutils.
-      for i in as ld ar ranlib nm strip otool install_name_tool lipo; do
+      for i in as ld ar ranlib nm strip otool install_name_tool lipo codesign_allocate; do
         cp ${cctools_}/bin/$i $out/bin
       done
 
       cp -d ${darwin.libtapi}/lib/libtapi* $out/lib
 
+      ${lib.optionalString targetPlatform.isx86_64 ''
         cp -rd ${pkgs.darwin.CF}/Library $out
+      ''}
 
       chmod -R u+w $out
 
       nuke-refs $out/bin/*
 
       rpathify() {
-        local libs=$(${cctools_}/bin/otool -L "$1" | tail -n +2 | grep -o "$NIX_STORE.*-\S*") || true
+        local libs=$(${stdenv.cc.targetPrefix}otool -L "$1" | tail -n +2 | grep -o "$NIX_STORE.*-\S*") || true
+        local newlib
         for lib in $libs; do
-          ${cctools_}/bin/install_name_tool -change $lib "@rpath/$(basename $lib)" "$1"
+          newlib=''${lib:${toString (storePrefixLen + 1)}}
+          newlib=''${newlib#*/}
+          ${stdenv.cc.targetPrefix}install_name_tool -change $lib "@rpath/$newlib" "$1"
         done
       }
 
@@ -116,20 +146,27 @@ in rec {
       for i in $out/bin/*; do
         if test -x $i -a ! -L $i; then
           chmod +w $i
-          strip $i || true
+          ${stdenv.cc.targetPrefix}strip $i || true
         fi
       done
 
-      for i in $out/bin/* $out/lib/*.dylib $out/lib/clang/*/lib/darwin/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
+      for i in $out/bin/* $out/lib/*.dylib $out/lib/darwin/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
         if test -x "$i" -a ! -L "$i"; then
           echo "Adding rpath to $i"
           rpathify $i
         fi
       done
 
+      for i in $out/bin/*; do
+        if test -x "$i" -a ! -L "$i" -a "$(basename $i)" != codesign; then
+          echo "Adding @executable_path to rpath in $i"
+          ${stdenv.cc.targetPrefix}install_name_tool -add_rpath '@executable_path/..' $i
+        fi
+      done
+
       nuke-refs $out/lib/*
       nuke-refs $out/lib/system/*
-      nuke-refs $out/lib/clang/*/lib/darwin/*
+      nuke-refs $out/lib/darwin/*
       nuke-refs $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
 
       mkdir $out/.pack
@@ -143,7 +180,7 @@ in rec {
       cp ${bzip2_.bin}/bin/bzip2 $out/on-server
 
       chmod u+w $out/on-server/*
-      strip $out/on-server/*
+      ${stdenv.cc.targetPrefix}strip $out/on-server/*
       nuke-refs $out/on-server/*
 
       (cd $out/pack && (find | cpio -o -H newc)) | bzip2 > $out/on-server/bootstrap-tools.cpio.bz2
@@ -318,7 +355,10 @@ in rec {
 
   # The ultimate test: bootstrap a whole stdenv from the tools specified above and get a package set out of it
   test-pkgs = import test-pkgspath {
-    inherit system;
+    # if the bootstrap tools are for another platform, we should be testing
+    # that platform.
+    system = if crossSystem != null then crossSystem else system;
+
     stdenvStages = args: let
         args' = args // { inherit bootstrapFiles; };
       in (import (test-pkgspath + "/pkgs/stdenv/darwin") args').stagesDarwin;

pkgs/stdenv/darwin/unpack-bootstrap-tools-aarch64.sh

@@ -0,0 +1,52 @@
+set -euo pipefail
+
+# Unpack the bootstrap tools tarball.
+echo Unpacking the bootstrap tools...
+$mkdir $out
+$bzip2 -d < $tarball | (cd $out && $cpio -i)
+
+export PATH=$out/bin
+
+# Fix codesign wrapper paths
+sed -i \
+  -e "1c\
+#!$out/bin/bash" \
+  -e "s|[^( ]*\bsigtool\b|$out/bin/sigtool|g" \
+  $out/bin/codesign
+
+updateInstallName() {
+  local path="$1"
+
+  cp "$path" "$path.new"
+  install_name_tool -id "$path" "$path.new"
+  codesign -f -i "$(basename "$path")" -s - "$path.new"
+  mv -f "$path.new" "$path"
+}
+
+find $out
+
+ln -s bash $out/bin/sh
+ln -s bzip2 $out/bin/bunzip2
+
+find $out/lib -type f -name '*.dylib' -print0 | while IFS= read -r -d $'\0' lib; do
+  updateInstallName "$lib"
+done
+
+# Provide a gunzip script.
+cat > $out/bin/gunzip <<EOF
+#!$out/bin/sh
+exec $out/bin/gzip -d "\$@"
+EOF
+chmod +x $out/bin/gunzip
+
+# Provide fgrep/egrep.
+echo "#! $out/bin/sh" > $out/bin/egrep
+echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
+echo "#! $out/bin/sh" > $out/bin/fgrep
+echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
+
+cat >$out/bin/dsymutil << EOF
+#!$out/bin/sh
+EOF
+
+chmod +x $out/bin/egrep $out/bin/fgrep $out/bin/dsymutil

pkgs/stdenv/default.nix

@@ -57,6 +57,7 @@ in
     powerpc64-linux = stagesLinux;
     powerpc64le-linux = stagesLinux;
     x86_64-darwin = stagesDarwin;
+    aarch64-darwin = stagesDarwin;
     x86_64-solaris = stagesNix;
     i686-cygwin = stagesNative;
     x86_64-cygwin = stagesNative;

pkgs/tools/archivers/gnutar/default.nix

@@ -30,9 +30,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "info" ];
 
-  buildInputs = [ ]
+  nativeBuildInputs = lib.optional stdenv.isDarwin autoreconfHook;
-    ++ lib.optional stdenv.isLinux acl
+  buildInputs = lib.optional stdenv.isLinux acl;
-    ++ lib.optional stdenv.isDarwin autoreconfHook;
 
   # May have some issues with root compilation because the bootstrap tool
   # cannot be used as a login shell for now.

pkgs/tools/compression/pbzx/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
   buildInputs = [ xz xar ];
   buildPhase = ''
-    cc pbzx.c -llzma -lxar -o pbzx
+    ${stdenv.cc.targetPrefix}cc pbzx.c -llzma -lxar -o pbzx
   '';
   installPhase = ''
     mkdir -p $out/bin

pkgs/tools/compression/xar/0001-Add-useless-descriptions-to-AC_DEFINE.patch

@@ -0,0 +1,95 @@
+From a14be07c0aae3bf6f732d1ca5f625ba375702121 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Sun, 15 Nov 2020 19:12:33 +0900
+Subject: [PATCH 1/2] Add useless descriptions to AC_DEFINE
+
+Removes autoheader warnings.
+---
+ configure.ac | 42 +++++++++++++++++++++---------------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 812b5ff..358ab89 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -210,48 +210,48 @@ AC_CHECK_MEMBERS([struct stat.st_flags])
+ 
+ AC_CHECK_SIZEOF(uid_t)
+ if test $ac_cv_sizeof_uid_t = "4"; then
+-AC_DEFINE(UID_STRING, RId32)
+-AC_DEFINE(UID_CAST, (uint32_t))
++AC_DEFINE([UID_STRING], RId32, [UID_STRING])
++AC_DEFINE([UID_CAST], (uint32_t), [UID_CAST])
+ elif test $ac_cv_sizeof_uid_t = "8"; then
+-AC_DEFINE(UID_STRING, PRId64)
+-AC_DEFINE(UID_CAST, (uint64_t))
++AC_DEFINE([UID_STRING], PRId64, [UID_STRING])
++AC_DEFINE([UID_CAST], (uint64_t), [UID_CAST])
+ else
+ AC_ERROR(can not detect the size of your system's uid_t type)
+ fi
+ 
+ AC_CHECK_SIZEOF(gid_t)
+ if test $ac_cv_sizeof_gid_t = "4"; then
+-AC_DEFINE(GID_STRING, PRId32)
+-AC_DEFINE(GID_CAST, (uint32_t))
++AC_DEFINE([GID_STRING], PRId32, [GID_STRING])
++AC_DEFINE([GID_CAST], (uint32_t), [GID_CAST])
+ elif test $ac_cv_sizeof_gid_t = "8"; then
+-AC_DEFINE(GID_STRING, PRId64)
+-AC_DEFINE(GID_CAST, (uint64_t))
++AC_DEFINE([GID_STRING], PRId64, [GID_STRING])
++AC_DEFINE([GID_CAST], (uint64_t), [GID_CAST])
+ else
+ AC_ERROR(can not detect the size of your system's gid_t type)
+ fi
+ 
+ AC_CHECK_SIZEOF(ino_t)
+ if test $ac_cv_sizeof_ino_t = "4"; then
+-AC_DEFINE(INO_STRING, PRId32)
+-AC_DEFINE(INO_HEXSTRING, PRIx32)
+-AC_DEFINE(INO_CAST, (uint32_t))
++AC_DEFINE([INO_STRING], PRId32, [INO_STRING])
++AC_DEFINE([INO_HEXSTRING], PRIx32, [INO_HEXSTRING])
++AC_DEFINE([INO_CAST], (uint32_t), [INO_CAST])
+ elif test $ac_cv_sizeof_ino_t = "8"; then
+-AC_DEFINE(INO_STRING, PRId64)
+-AC_DEFINE(INO_HEXSTRING, PRIx64)
+-AC_DEFINE(INO_CAST, (uint64_t))
++AC_DEFINE([INO_STRING], PRId64, [INO_STRING])
++AC_DEFINE([INO_HEXSTRING], PRIx64, [INO_HEXSTRING])
++AC_DEFINE([INO_CAST], (uint64_t), [INO_CAST])
+ else
+ AC_ERROR(can not detect the size of your system's ino_t type)
+ fi
+ 
+ AC_CHECK_SIZEOF(dev_t)
+ if test $ac_cv_sizeof_dev_t = "4"; then
+-AC_DEFINE(DEV_STRING, PRId32)
+-AC_DEFINE(DEV_HEXSTRING, PRIx32)
+-AC_DEFINE(DEV_CAST, (uint32_t))
++AC_DEFINE([DEV_STRING], PRId32, [DEV_STRING])
++AC_DEFINE([DEV_HEXSTRING], PRIx32, [DEV_HEXSTRING])
++AC_DEFINE([DEV_CAST], (uint32_t), [DEV_CAST])
+ elif test $ac_cv_sizeof_dev_t = "8"; then
+-AC_DEFINE(DEV_STRING, PRId64)
+-AC_DEFINE(DEV_HEXSTRING, PRIx64)
+-AC_DEFINE(DEV_CAST, (uint64_t))
++AC_DEFINE([DEV_STRING], PRId64, [DEV_STRING])
++AC_DEFINE([DEV_HEXSTRING], PRIx64, [DEV_HEXSTRING])
++AC_DEFINE([DEV_CAST], (uint64_t), [DEV_CAST])
+ else
+ AC_ERROR(can not detect the size of your system's dev_t type)
+ fi
+@@ -261,7 +261,7 @@ AC_CHECK_LIB(acl, acl_get_file)
+ dnl Check for paths
+ AC_PREFIX_DEFAULT(/usr/local)
+ 
+-AC_CHECK_FUNC([asprintf], AC_DEFINE([HAVE_ASPRINTF]))
++AC_CHECK_FUNC([asprintf], AC_DEFINE([HAVE_ASPRINTF], [], [HAVE_ASPRINTF]))
+ 
+ dnl 
+ dnl Configure libxml2.
+-- 
+2.28.0
+

pkgs/tools/compression/xar/0002-Use-pkg-config-for-libxml2.patch

@@ -0,0 +1,89 @@
+From 276833851657c85651c053ee16b8e1a8dc768a50 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Sun, 15 Nov 2020 19:12:56 +0900
+Subject: [PATCH 2/2] Use pkg-config for libxml2
+
+---
+ configure.ac | 66 +++++++++-------------------------------------------
+ 1 file changed, 11 insertions(+), 55 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 358ab89..984a694 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -268,61 +268,17 @@ dnl Configure libxml2.
+ dnl 
+ LIBXML2_VERSION_MIN=2.6.11
+ 
+-have_libxml2="1"
+-
+-AC_ARG_WITH([xml2-config], [  --with-xml2-config      libxml2 config program],
+-if test "x${with_xml2_config}" = "xno" ; then
+-  XML2_CONFIG=
+-else
+-  XML2_CONFIG="${with_xml2_config}"
+-fi
+-,
+-  XML2_CONFIG=
+-)
+-if test "x${XML2_CONFIG}" != "x" ; then
+-   if test ! -x "${XML2_CONFIG}" ; then
+-     AC_MSG_ERROR([Unusable or missing xml2-config: ${XML2_CONFIG}])
+-   fi
+-else
+-  AC_PATH_PROG([XML2_CONFIG], [xml2-config], , [${PATH}])
+-  if test "x${XML2_CONFIG}" = "x" ; then
+-    AC_MSG_ERROR([Cannot configure without xml2-config])
+-  fi
+-fi
+-
+-dnl Make sure the version of libxml2 found is sufficient.
+-AC_MSG_CHECKING([for libxml >= ${LIBXML2_VERSION_MIN}])
+-LIBXML2_FOUND=`2>&1 ${XML2_CONFIG} --version`
+-LIBXML2_MAJOR=`echo ${LIBXML2_FOUND} | tr . " " | awk '{print $1}'`
+-LIBXML2_MINOR=`echo ${LIBXML2_FOUND} | tr . " " | awk '{print $2}' | tr a-z " " |awk '{print $1}'`
+-LIBXML2_BRANCH=`echo ${LIBXML2_FOUND} | tr . " " | awk '{print $3}' | tr a-z " " |awk '{print $1}'`
+-if test "x${LIBXML2_BRANCH}" = "x" ; then
+-  LIBXML2_BRANCH=0
+-fi
+-LIBXML2_MAJOR_MIN=`echo ${LIBXML2_VERSION_MIN} | tr . " " | awk '{print $1}'`
+-LIBXML2_MINOR_MIN=`echo ${LIBXML2_VERSION_MIN} | tr . " " | awk '{print $2}'`
+-LIBXML2_BRANCH_MIN=`echo ${LIBXML2_VERSION_MIN} | tr . " " | awk '{print $3}'`
+-if test ${LIBXML2_MAJOR} -gt ${LIBXML2_MAJOR_MIN} \
+-     -o ${LIBXML2_MAJOR} -eq ${LIBXML2_MAJOR_MIN} \
+-     -a ${LIBXML2_MINOR} -gt ${LIBXML2_MINOR_MIN} \
+-     -o ${LIBXML2_MAJOR} -eq ${LIBXML2_MAJOR_MIN} \
+-     -a ${LIBXML2_MINOR} -eq ${LIBXML2_MINOR_MIN} \
+-     -a ${LIBXML2_BRANCH} -ge $LIBXML2_BRANCH_MIN ; then
+-  AC_MSG_RESULT([${LIBXML2_MAJOR}.${LIBXML2_MINOR}.${LIBXML2_BRANCH}])
+-  have_libxml2="1"
+-  CPPFLAGS="${CPPFLAGS} `${XML2_CONFIG} --cflags`"
+-  LIBS="${LIBS} `${XML2_CONFIG} --libs`"
+-else
+-  AC_MSG_RESULT([no])
+-  have_libxml2="0"
+-fi
+-if test "x${have_libxml2}" = "x1" ; then
+-  dnl Final sanity check, to make sure that xmlwriter is present.
+-  AC_CHECK_HEADER([libxml/xmlwriter.h], , [have_libxml2="0"])
+-fi
+-if test "x${have_libxml2}" = "x0" ; then
+-  AC_MSG_ERROR([Cannot build without libxml2])
+-fi
++PKG_PROG_PKG_CONFIG
++
++PKG_CHECK_MODULES(LIBXML2_PKGCONFIG, [libxml-2.0 >= ${LIBXML2_VERSION_MIN}],
++  [
++    have_libxml2=1
++    CPPFLAGS="${CPPFLAGS} ${LIBXML2_PKGCONFIG_CFLAGS}"
++    LIBS="${LIBS} ${LIBXML2_PKGCONFIG_LIBS}"
++  ],
++  [
++    have_libxml2=0
++  ])
+ 
+ dnl 
+ dnl Configure libcrypto (part of OpenSSL).
+-- 
+2.28.0
+

pkgs/tools/compression/xar/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libxml2, xz, openssl, zlib, bzip2, fts, autoconf }:
+{ lib, stdenv, fetchurl, pkg-config, libxml2, xz, openssl, zlib, bzip2, fts, autoreconfHook }:
 
 stdenv.mkDerivation rec {
   version = "1.6.1";
@@ -9,16 +9,20 @@ stdenv.mkDerivation rec {
     sha256 = "0ghmsbs6xwg1092v7pjcibmk5wkyifwxw6ygp08gfz25d2chhipf";
   };
 
-  buildInputs = [ libxml2 xz openssl zlib bzip2 fts autoconf ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libxml2 xz openssl zlib bzip2 fts ];
 
-  prePatch = ''
+  patches = [
+    ./0001-Add-useless-descriptions-to-AC_DEFINE.patch
+    ./0002-Use-pkg-config-for-libxml2.patch
+  ];
+
+  postPatch = ''
     substituteInPlace configure.ac \
       --replace 'OpenSSL_add_all_ciphers' 'OPENSSL_init_crypto' \
       --replace 'openssl/evp.h' 'openssl/crypto.h'
   '';
 
-  preConfigure = "./autogen.sh";
-
   meta = {
     homepage    = "https://mackyle.github.io/xar/";
     description = "Extensible Archiver";

pkgs/tools/misc/mc/default.nix

@@ -16,6 +16,7 @@
 , openssl
 , coreutils
 , autoreconfHook
+, autoSignDarwinBinariesHook
 }:
 
 stdenv.mkDerivation rec {
@@ -27,7 +28,12 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xt6txQWV8tmiLcbCmanyizk+NYNG6/bKREqEadwWbCc=";
   };
 
-  nativeBuildInputs = [ pkg-config autoreconfHook unzip ];
+  nativeBuildInputs = [ pkg-config autoreconfHook unzip ]
+    # The preFixup hook rewrites the binary, which invaliates the code
+    # signature. Add the fixup hook to sign the output.
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+      autoSignDarwinBinariesHook
+    ];
 
   buildInputs = [
     file

pkgs/tools/networking/curl/default.nix

@@ -7,8 +7,15 @@
 , gnutlsSupport ? false, gnutls ? null
 , wolfsslSupport ? false, wolfssl ? null
 , scpSupport ? zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin, libssh2 ? null
-, # a very sad story re static: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439039
+, gssSupport ? with stdenv.hostPlatform; !(
-  gssSupport ? with stdenv.hostPlatform; !isWindows && !isStatic, libkrb5 ? null
+    !isWindows &&
+    # a very sad story re static: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439039
+    !isStatic &&
+    # the "mig" tool does not configure its compiler correctly. This could be
+    # fixed in mig, but losing gss support on cross compilation to darwin is
+    # not worth the effort.
+    !(isDarwin && (stdenv.buildPlatform != stdenv.hostPlatform))
+  ), libkrb5 ? null
 , c-aresSupport ? false, c-ares ? null
 , brotliSupport ? false, brotli ? null
 }:

pkgs/tools/networking/openssh/common.nix

@@ -19,7 +19,7 @@
 , pkg-config
 , pam
 , etcDir ? null
-, withKerberos ? true
+, withKerberos ? !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
 , libkrb5
 , libfido2
 , nixosTests

pkgs/tools/networking/vde2/default.nix

@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  preConfigure = lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinMinVersion "11") ''
+    MACOSX_DEPLOYMENT_TARGET=10.16
+  '';
+
   configureFlags = lib.optional (!withPython) "--disable-python";
 
   buildInputs = [ openssl libpcap ]

pkgs/tools/text/groff/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, perl
+{ lib, stdenv, fetchurl, fetchpatch, perl
 , ghostscript #for postscript and html output
 , psutils, netpbm #for html output
 , buildPackages
@@ -22,6 +22,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001-Fix-cross-compilation-by-looking-for-ar.patch
+  ]
+  ++ lib.optionals (stdenv.cc.isClang && lib.versionAtLeast stdenv.cc.version "9") [
+    # https://trac.macports.org/ticket/59783
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/openembedded/openembedded-core/ce265cf467f1c3e5ba2edbfbef2170df1a727a52/meta/recipes-extended/groff/files/0001-Include-config.h.patch";
+      sha256 = "1b0mg31xkpxkzlx696nr08rcc7ndpaxdplvysy0hw5099c4n1wyf";
+    })
   ];
 
   postPatch = lib.optionalString (psutils != null) ''

pkgs/top-level/all-packages.nix

@@ -30,7 +30,18 @@ in
   # just the plain stdenv.
   stdenv_32bit = lowPrio (if stdenv.hostPlatform.is32bit then stdenv else multiStdenv);
 
-  stdenvNoCC = stdenv.override { cc = null; hasCC = false; };
+  stdenvNoCC = stdenv.override (
+    { cc = null; hasCC = false; }
+
+    // lib.optionalAttrs (stdenv.hostPlatform.isDarwin && (stdenv.hostPlatform != stdenv.buildPlatform)) {
+      # TODO: This is a hack to use stdenvNoCC to produce a CF when cross
+      # compiling. It's not very sound. The cross stdenv has:
+      #   extraBuildInputs = [ targetPackages.darwin.apple_sdks.frameworks.CoreFoundation ]
+      # and uses stdenvNoCC. In order to make this not infinitely recursive, we need to exclude
+      # this extraBuildInput.
+      extraBuildInputs = [];
+    }
+  );
 
   mkStdenvNoLibs = stdenv: let
     bintools = stdenv.cc.bintools.override {
@@ -627,11 +638,15 @@ in
 
   replaceDependency = callPackage ../build-support/replace-dependency.nix { };
 
-  nukeReferences = callPackage ../build-support/nuke-references { };
+  nukeReferences = callPackage ../build-support/nuke-references {
+    inherit (darwin) signingUtils;
+  };
 
   referencesByPopularity = callPackage ../build-support/references-by-popularity { };
 
-  removeReferencesTo = callPackage ../build-support/remove-references-to { };
+  removeReferencesTo = callPackage ../build-support/remove-references-to {
+    inherit (darwin) signingUtils;
+  };
 
   vmTools = callPackage ../build-support/vm { };
 
@@ -641,7 +656,9 @@ in
 
   setJavaClassPath = makeSetupHook { } ../build-support/setup-hooks/set-java-classpath.sh;
 
-  fixDarwinDylibNames = makeSetupHook { } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
+  fixDarwinDylibNames = makeSetupHook {
+    substitutions = { inherit (binutils) targetPrefix; };
+  } ../build-support/setup-hooks/fix-darwin-dylib-names.sh;
 
   keepBuildTree = makeSetupHook { } ../build-support/setup-hooks/keep-build-tree.sh;
 
@@ -6677,7 +6694,9 @@ in
 
   mbutil = python3Packages.callPackage ../applications/misc/mbutil { };
 
-  mc = callPackage ../tools/misc/mc { };
+  mc = callPackage ../tools/misc/mc {
+    inherit (darwin) autoSignDarwinBinariesHook;
+  };
 
   mcabber = callPackage ../applications/networking/instant-messengers/mcabber { };
 
@@ -9985,15 +10004,21 @@ in
 
   any-nix-shell = callPackage ../shells/any-nix-shell { };
 
-  bash = lowPrio (callPackage ../shells/bash/4.4.nix { });
+  bash = lowPrio (callPackage ../shells/bash/4.4.nix {
-  bash_5 = lowPrio (callPackage ../shells/bash/5.1.nix { });
+    binutils = stdenv.cc.bintools;
+  });
+  bash_5 = lowPrio (callPackage ../shells/bash/5.1.nix {
+    binutils = stdenv.cc.bintools;
+  });
   bashInteractive_5 = lowPrio (callPackage ../shells/bash/5.1.nix {
+    binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;
   });
 
   # WARNING: this attribute is used by nix-shell so it shouldn't be removed/renamed
   bashInteractive = callPackage ../shells/bash/4.4.nix {
+    binutils = stdenv.cc.bintools;
     interactive = true;
     withDocs = true;
   };
@@ -11223,7 +11248,7 @@ in
     # This returns the minimum suported version for the platform. The
     # assumption is that or any later version is good.
     choose = platform:
-      /**/ if platform.isDarwin then 7
+      /**/ if platform.isDarwin then (if platform.isAarch64 then 11 else 7)
       else if platform.isFreeBSD then 7
       else if platform.isAndroid then 12
       else if platform.isLinux then 7
@@ -11837,6 +11862,7 @@ in
     noLibc = (self.libc == null);
 
     inherit bintools libc;
+    inherit (darwin) postLinkSignHook signingUtils;
   } // extraArgs; in self);
 
   yaml-language-server = nodePackages.yaml-language-server;
@@ -14821,6 +14847,7 @@ in
     inherit (stdenv.targetPlatform) libc;
   in     if libc == "msvcrt" then targetPackages.windows.mingw_w64_headers or windows.mingw_w64_headers
     else if libc == "nblibc" then targetPackages.netbsdCross.headers or netbsdCross.headers
+    else if libc == "libSystem" && stdenv.targetPlatform.isAarch64 then targetPackages.darwin.LibsystemCross or darwin.LibsystemCross
     else null;
 
   # We can choose:
@@ -14840,7 +14867,7 @@ in
     else if name == "libSystem" then
       if stdenv.targetPlatform.useiOSPrebuilt
       then targetPackages.darwin.iosSdkPkgs.libraries or darwin.iosSdkPkgs.libraries
-      else throw "don't yet have a `targetPackages.darwin.LibsystemCross`"
+      else targetPackages.darwin.LibsystemCross or (throw "don't yet have a `targetPackages.darwin.LibsystemCross for ${stdenv.targetPlatform.config}`")
     else if name == "nblibc" then targetPackages.netbsdCross.libc or netbsdCross.libc
     else if name == "wasilibc" then targetPackages.wasilibc or wasilibc
     else if name == "relibc" then targetPackages.relibc or relibc

pkgs/top-level/darwin-packages.nix

@@ -14,6 +14,12 @@ let
     selfTargetTarget = pkgsTargetTarget.darwin or {}; # might be missing
   };
 
+  # Prefix for binaries. Customarily ends with a dash separator.
+  #
+  # TODO(@Ericson2314) Make unconditional, or optional but always true by
+  # default.
+  targetPrefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
+                                        (stdenv.targetPlatform.config + "-");
 in
 
 lib.makeScopeWithSplicing splicePackages newScope otherSplices (_: {}) (spliced: spliced.apple_sdk.frameworks) (self: let
@@ -21,17 +27,48 @@ lib.makeScopeWithSplicing splicePackages newScope otherSplices (_: {}) (spliced:
 
   # Must use pkgs.callPackage to avoid infinite recursion.
 
-  apple-source-releases = pkgs.callPackage ../os-specific/darwin/apple-source-releases { } self;
+  # Open source packages that are built from source
+  appleSourcePackages = pkgs.callPackage ../os-specific/darwin/apple-source-releases { } self;
 
   impure-cmds = pkgs.callPackage ../os-specific/darwin/impure-cmds { };
 
-  apple_sdk = pkgs.callPackage ../os-specific/darwin/apple-sdk {
+  # macOS 10.12 SDK
+  apple_sdk_10_12 = pkgs.callPackage ../os-specific/darwin/apple-sdk {
     inherit (buildPackages.darwin) print-reexports;
     inherit (self) darwin-stubs;
   };
+
+  # macOS 11.0 SDK
+  apple_sdk_11_0 = pkgs.callPackage ../os-specific/darwin/apple-sdk-11.0 { };
+
+  # Pick an SDK
+  apple_sdk = if stdenv.hostPlatform.isAarch64 then apple_sdk_11_0 else apple_sdk_10_12;
+
+  # Pick the source of libraries: either Apple's open source releases, or the
+  # SDK.
+  useAppleSDKLibs = stdenv.hostPlatform.isAarch64;
+
+  selectAttrs = attrs: names:
+    lib.listToAttrs (lib.concatMap (n: if attrs ? "${n}" then [(lib.nameValuePair n attrs."${n}")] else []) names);
+
+  chooseLibs = (
+    # There are differences in which libraries are exported. Avoid evaluation
+    # errors when a package is not provided.
+    selectAttrs (
+      if useAppleSDKLibs
+        then apple_sdk
+        else appleSourcePackages
+    ) ["Libsystem" "LibsystemCross" "libcharset" "libunwind" "objc4" "configd" "IOKit"]
+  ) // {
+    inherit (
+      if useAppleSDKLibs
+        then apple_sdk.frameworks
+        else appleSourcePackages
+    ) Security;
+  };
 in
 
-impure-cmds // apple-source-releases // {
+impure-cmds // appleSourcePackages // chooseLibs // {
 
   inherit apple_sdk;
 
@@ -41,7 +78,7 @@ impure-cmds // apple-source-releases // {
 
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
     inherit (pkgs) binutils-unwrapped;
-    inherit (pkgs.llvmPackages_7) llvm clang-unwrapped;
+    inherit (pkgs.llvmPackages) llvm clang-unwrapped;
   };
 
   binutils = pkgs.wrapBintoolsWith {
@@ -59,7 +96,6 @@ impure-cmds // apple-source-releases // {
 
   cctools = callPackage ../os-specific/darwin/cctools/port.nix {
     stdenv = if stdenv.isDarwin then stdenv else pkgs.libcxxStdenv;
-    libcxxabi = pkgs.libcxxabi;
   };
 
   # TODO: remove alias.
@@ -69,7 +105,31 @@ impure-cmds // apple-source-releases // {
 
   darwin-stubs = callPackage ../os-specific/darwin/darwin-stubs { };
 
-  print-reexports = callPackage ../os-specific/darwin/apple-sdk/print-reexports { };
+  print-reexports = callPackage ../os-specific/darwin/print-reexports { };
+
+  rewrite-tbd = callPackage ../os-specific/darwin/rewrite-tbd { };
+
+  checkReexportsHook = pkgs.makeSetupHook {
+    deps = [ pkgs.darwin.print-reexports ];
+  } ../os-specific/darwin/print-reexports/setup-hook.sh;
+
+  sigtool = callPackage ../os-specific/darwin/sigtool { };
+
+  postLinkSignHook = pkgs.writeTextFile {
+    name = "post-link-sign-hook";
+    executable = true;
+
+    text = ''
+      CODESIGN_ALLOCATE=${targetPrefix}codesign_allocate \
+        ${self.sigtool}/bin/codesign -f -s - "$linkerOutput"
+    '';
+  };
+
+  signingUtils = callPackage ../os-specific/darwin/signing-utils { };
+
+  autoSignDarwinBinariesHook = pkgs.makeSetupHook {
+    deps = [ self.signingUtils ];
+  } ../os-specific/darwin/signing-utils/auto-sign-hook.sh;
 
   maloader = callPackage ../os-specific/darwin/maloader {
   };
@@ -84,7 +144,7 @@ impure-cmds // apple-source-releases // {
 
   iproute2mac = callPackage ../os-specific/darwin/iproute2mac { };
 
-  libobjc = apple-source-releases.objc4;
+  libobjc = self.objc4;
 
   lsusb = callPackage ../os-specific/darwin/lsusb { };
 
@@ -105,7 +165,26 @@ impure-cmds // apple-source-releases // {
 
   CoreSymbolication = callPackage ../os-specific/darwin/CoreSymbolication { };
 
-  CF = callPackage ../os-specific/darwin/swift-corelibs/corefoundation.nix { };
+  # TODO: make swift-corefoundation build with apple_sdk_11_0.Libsystem
+  CF = if useAppleSDKLibs
+    then
+      # This attribute (CF) is included in extraBuildInputs in the stdenv. This
+      # is typically the open source project. When a project refers to
+      # "CoreFoundation" it has an extra setup hook to force impure system
+      # CoreFoundation into the link step.
+      #
+      # In this branch, we only have a single "CoreFoundation" to choose from.
+      # To be compatible with the existing convention, we define
+      # CoreFoundation with the setup hook, and CF as the same package but
+      # with the setup hook removed.
+      #
+      # This may seem unimportant, but without it packages (e.g., bacula) will
+      # fail with linker errors referring ___CFConstantStringClassReference.
+      # It's not clear to me why some packages need this extra setup.
+      lib.overrideDerivation apple_sdk.frameworks.CoreFoundation (drv: {
+        setupHook = null;
+      })
+    else callPackage ../os-specific/darwin/swift-corelibs/corefoundation.nix { };
 
   # As the name says, this is broken, but I don't want to lose it since it's a direction we want to go in
   # libdispatch-broken = callPackage ../os-specific/darwin/swift-corelibs/libdispatch.nix { };

pkgs/top-level/release-lib.nix

@@ -27,6 +27,7 @@ rec {
     pkgs_x86_64_linux = packageSet' { system = "x86_64-linux"; };
     pkgs_i686_linux = packageSet' { system = "i686-linux"; };
     pkgs_aarch64_linux = packageSet' { system = "aarch64-linux"; };
+    pkgs_aarch64_darwin = packageSet' { system = "aarch64-darwin"; };
     pkgs_armv6l_linux = packageSet' { system = "armv6l-linux"; };
     pkgs_armv7l_linux = packageSet' { system = "armv7l-linux"; };
     pkgs_x86_64_darwin = packageSet' { system = "x86_64-darwin"; };
@@ -39,6 +40,7 @@ rec {
       if system == "x86_64-linux" then pkgs_x86_64_linux
       else if system == "i686-linux" then pkgs_i686_linux
       else if system == "aarch64-linux" then pkgs_aarch64_linux
+      else if system == "aarch64-darwin" then pkgs_aarch64_darwin
       else if system == "armv6l-linux" then pkgs_armv6l_linux
       else if system == "armv7l-linux" then pkgs_armv7l_linux
       else if system == "x86_64-darwin" then pkgs_x86_64_darwin